Tag Archives: Red Hat Enterprise

Linux

iptables not logging

Leave a comment

By christr

I need to log iptables to see what ports are being dropped. I followed this article and several others I looked at via Google, but it’s still not working.

Red Hat Magazine | How do I add logging for iptables using the /etc/sysconfig/iptables file for Red Hat Enterprise Linux4?

I added the following entry to my /etc/sysconfig/iptables file just before the last COMMIT line:

Code:
-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example#
-A RH-Firewall-1-INPUT -j LOG
COMMIT

I’ve also tried it as shown:

Code:
-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example#
#log
-A RH-Firewall-1-INPUT -j LOG
#drop all other packets
-A RH-Firewall-1-INPUT -j DROP
COMMIT

My problem is when I got to /var/log/messages I don’t see it logging anything whatsoever from iptables.

I also added the following to /etc/syslog.conf:

Code:
kern.* /var/log/debug

Still no matter what I do no information shows up in any log files, and I’ve tried numerous ports on this host that I know aren’t opened in iptables from another test host in hopes that I would see it logging the dropped connection attempts, but nothing I’ve done will log anything whatsoever.

I’ve also tried using this article for advise, but still nothing I do works:
Example iptables firewall

Any advise would be greatly appreciated. This is on Red Hat Enterprise 5.7. Every time I make these changes I of course restart the iptables and syslog services.

…read more
Source: FULL ARTICLE at The UNIX and Linux Forums