How to determine what traffic is being dropped / blocked base on iptables log

Question

I have followed the example for iptable logging from https://help.ubuntu.com/community/IptablesHowTo#More_detailed_Logging

sudo iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

I get log entries like below

Oct 20 03:45:50 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=1059 TOS=0x00 PREC=0x00 TTL=115 ID=31368 DF PROTO=TCP SPT=17992 DPT=80 WINDOW=16477 RES=0x00 ACK PSH URGP=0 
Oct 20 03:46:02 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=763 DF PROTO=TCP SPT=20229 DPT=22 WINDOW=15588 RES=0x00 ACK URGP=0 
Oct 20 03:46:14 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=324 TOS=0x00 PREC=0x00 TTL=49 ID=64245 PROTO=TCP SPT=47237 DPT=80 WINDOW=470 RES=0x00 ACK PSH URGP=0 
Oct 20 03:46:26 hostname kernel: iptables denied: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=x.x.x.x DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=45 ID=2010 PROTO=TCP SPT=48322 DPT=80 WINDOW=380 RES=0x00 ACK URGP=0

Similar log above appears every 2 - 3 seconds seems like there is a lot of traffic being blocked. But my question is how do I determine what sort of traffic is being blocked or dropped base on the log entries above?

Is DPT means destination port? so DPT=22 means SSH access is blocked? and DPT=80 means HTTP traffic is blocked?

My iptables are mainly default values, except I have added a few additional rules

-A INPUT -s z.z.z.z/32 -j DROP
-A INPUT -s y.y.y.y/32 -j DROP
-A INPUT -s a.a.a.a/32 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

None of the SRC ip in the log files are from the iptables that is specifically configured to drop all traffic, and yet the log files showing different ip address with DPT=80, DPT=22 being dropped.

Is there something wrong with my config?

Yes, something is most likely wrong with your configuration. What are you trying to do exactly? Yes, port 22 is SSH and 80 is HTTP and DPT is destination port, so you are logging some HTTP and SSH traffic. What is your goal? Are you trying to log traffic without affecting it? Are you trying to reject traffic? The "limit" module is used to match in a rate limited fashion. — Eddie, Oct 20 '14 at 03:09
Hi Eddie, I am just trying to block all traffic from certain IP, hence the additional rules like -A INPUT -s z.z.z.z/32 -j DROP -A INPUT -s y.y.y.y/32 -j DROP -A INPUT -s a.a.a.a/32 -j DROP — forestclown, Oct 20 '14 at 03:13
This rule `-m limit --limit 5/min -j LOG --log-prefix "iptables denied: ` will log all packets matching it but no more than five per minute. It doesn't actually deny them, despite what the log prefix is set to. Do you want to *log* and block all traffic from a certain IP? — Eddie, Oct 20 '14 at 03:15
If the IP I am blocking in iptables are actually proxy servers, will that explain why different SRC address is logged? — forestclown, Oct 20 '14 at 03:15

Eddie · Accepted Answer · 2014-10-20T03:23:58.250

Here are your rules again:

-A INPUT -s z.z.z.z/32 -j DROP
-A INPUT -s y.y.y.y/32 -j DROP
-A INPUT -s a.a.a.a/32 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

The first will will silently drop any packet matching it. As will the second and third. By the time you hit the "limit" rule, you have already dropped all packets matching those source IP addresses. You now have the rest of the traffic. For this rest of the traffic, you will log five packets per minute. You will misleadingly log them as denied when they are not actually denied.

If, instead, you want to log and drop packets matching any one of several source IP addresses, the easiest way to do this is to create a new chain that will log and drop. e.g.:

iptables -N LOG_AND_DROP
iptables -A LOG_AND_DROP -j LOG --log-prefix "Source host denied "
iptables -A LOG_AND_DROP -j DROP

Now that you have this chain, you want to direct traffic to log and drop to it:

iptables -A INPUT -s z.z.z.z/32 -j LOG_AND_DROP
iptables -A INPUT -s y.y.y.y/32 -j LOG_AND_DROP
iptables -A INPUT -s a.a.a.a/32 -j LOG_AND_DROP

This will take any packet matching those source addresses and send it to the LOG_AND_DROP chain. This chain, as it is named, first logs every single packet and then drops it. If you prefer, you can rate limit the logging and then drop it. Up to you, and depends on how much traffic we're talking about.

Note: Make sure you flush existing rules before adding the above rules. Otherwise you'll still have the misleading rule in there that is logging but not denying.

Will this also account for ipv6? or there will be a separate rules needed for ipv6? — forestclown, Oct 20 '14 at 05:16
Is there any way not to re-create DROP rules though? E.g. in my case I have a custom system with various rules *(some of which I presume might be created by a service at runtime)*, and I just want to debug whether specific traffic being dropped. Re-creating these rules does not sound realistic. — Hi-Angel, Jun 29 '23 at 13:25

How to determine what traffic is being dropped / blocked base on iptables log

1 Answers1