2

If you don't give iptables a target, it simply counts how many bytes and packets match the rule. I'd like to count all packets that come from outside, i.e. don't match 10.0.0.0/8 and don't match 192.168.0.0/16.

My first intuition is:

iptables -A INPUT ! -s 10.0.0.0/8,192.168.0.0/16

However this adds two rules, of which each count separately, and no count of outside packets is discernible. So how do I count outside packets?

Shelvacu
  • 373
  • 1
  • 2
  • 15

1 Answers1

3

I would be tempted to do something like this by creating a chain. Then adding rules to the chain to return the stuff you don't want. The stuff that lasts to the final rule of the chain will be the stuff you do want.

# untested
# create a new input counter chain
/sbin/iptables -t filter -N inputcounter
# redirect all traffic to chain
/sbin/iptables -t filter -A INPUT -j inputcounter
# return stuff we don't want to count
/sbin/iptables -t filter -A inputcounter -s 10.0.0.0/8 -j RETURN
/sbin/iptables -t filter -A inputcounter -s 192.168.0.0/16 -j RETURN
# Final rule will return everything else.  This should be a count of 
# everything that wasn't not previously excluded
/sbin/iptables -t filter -A inputcounter -j RETURN
Zoredache
  • 130,897
  • 41
  • 276
  • 420