Logging connections
I have a hole punched in our iptables configuration for an internet
application we're using to be able to reach an internal server directly. What I'd like to do now is log the connections that are coming in to that port. Ideally I would want the remote address it's coming from, a time stamp and what the connection is wanting to do (send/receive.)
The rules related to that hole are setup like this:
-A PREROUTING -i eth0 -p tcp -m tcp --dport 6666 -j DNAT
--to-destination 192.168.x.x
-A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp
--dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
Signature · 6 lines
H | I haven't lost my mind; it's backed up on tape somewhere. +-------------------------------------------------------------------- Ashley M. Kirchner <mailto:[email protected]> . 303.442.6410 x130 IT Director / SysAdmin / WebSmith . 800.441.3873 x130 Photo Craft Imaging . 3550 Arapahoe Ave. #6 http://www.pcraft.com ..... . . . Boulder, CO 80303, U.S.A.
So add the same rule you have in FORWARD with -j LOG before the ACCEPT one.
-A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp --dport 6666 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix="punched_hole"
-A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp --dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
Quoted 14 lines · Ashley M. Kirchner
I have a hole punched in our iptables configuration for an internet
application we're using to be able to reach an internal server directly. What I'd like to do now is log the connections that are coming in to that port. Ideally I would want the remote address it's coming from, a time stamp and what the connection is wanting to do (send/receive.)The rules related to that hole are setup like this:
-A PREROUTING -i eth0 -p tcp -m tcp --dport 6666 -j DNAT
--to-destination 192.168.x.x-A FORWARD -i eth0 -o eth2 -p tcp -m state --state NEW -m tcp--dport 6666 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
Signature · 9 lines
Ing. Eduardo Spremolla Jefe I+D Antel Uruguay Este e-mail y cualquier posible archivo adjunto está dirigido únicamente al destinatario del mensaje y contiene información que puede ser confidencial. Si Ud. no es el destinatario correcto por favor notifique al remitente respondiendo este mensaje y elimine inmediatamente el e-mail y los posibles archivos adjuntos al mismo de su sistema. Está prohibida cualquier utilización, difusión o copia de este e-mail por cualquier persona o entidad que no sean las específicas destinatarias del mensaje. ANTEL no acepta ninguna responsabilidad con respecto a cualquier comunicación que haya sido emitida incumpliendo nuestra Política de Seguridad de la Información. . . . . . . . . . This e-mail and any attachment is confidential and is intended solely for the addressee(s). If you are not intended recipient please inform the sender immediately, answering this e-mail and delete it as well as the attached files. Any use, circulation or copy of this e-mail by any person or entity that is not the specific addressee(s) is prohibited. ANTEL is not responsible for any communication emitted without respecting our Information Security Policy.