Iptables rules problem

menonrr_at_jmu.edu
Date: 10/15/04

  • Next message: rooker: "Re: dialup router" 
    Date: Thu, 14 Oct 2004 21:13:31 -0400
To: Redhat <redhat-list@redhat.com>

    10/14

    Hello,

    I needed to send my syslog from 192.16.1.10 (firewall/GW) to
    192.168.1.3, the logserver. The syslogging worked. But since I
    am monitoring all connections going to the internal
    network(eth0) from outside, the log was filled with the syslog
    connections from the gateway to the logserver.

    So I gave 2 rules to help me with that:

    To log the syslog traffic (just testing syslog)

    #$IPTABLES -A OUTPUT -o eth0 -p udp -s 192.168.1.10/32
    --source-port 514 -d 192.168.1.3/32 --destination-port 514 -m
    limit --limit 15/minute --limit-burst 10 -j LOG --log-prefix
    "Syslog traffictoTest: " # Log packets going to 192.168.1.0

    (Rule I really need to log inbound traffic)

    #$IPTABLES -A OUTPUT -o eth0 -p udp --destination-port ! 514
    -m limit --limit 1/second --limit-burst 10 -j LOG --log-prefix
    "Output packetsToTest: " # Log packets entering testnet except
    udp 514 for syslog

    ----------------
    The Problem:

    -----------------
    Only the syslog traffic is received. I lost all logging of
    inbound traffic.

    I would appreciate some help on this.

    Thanks.
    Menon 

    -- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: rooker: "Re: dialup router"

    Relevant Pages

    • Re: Syslog server
      ... firewall device that needs a syslog server? ... Does it then accept any connections sent to it or do you still have to ... If I did this could I then point my firewall to ... The webmail thing you were posting with earlier seems to ...
      (Ubuntu)
    • Re: Iptables rules problem
      ... the log was filled with the syslog ... > connections from the gateway to the logserver. ... It looks like you are currently logging (if on the FW/GW): ...
      (RedHat)
    • Re: How to get a report of VPN connections on a PIX
      ... different VPN connections from users running Cisco VPN Clients. ... I would like to get a report of the users who connect to the PIX every ... My idea was to monitor the syslog and send an alert when a specific ... Linux to provide authentication/accounting for vpn clients. ...
      (comp.dcom.sys.cisco)
    • How to get a report of VPN connections on a PIX
      ... different VPN connections from users running Cisco VPN Clients. ... I would like to get a report of the users who connect to the PIX every ... My idea was to monitor the syslog and send an alert when a specific ...
      (comp.dcom.sys.cisco)
    • some ssh connections not logged
      ... My syslog is also set up to get those messages into a file. ... I can see almost all incomming ssh connections logged. ... I have set up a monitoring system that does a ptree of that user: ... But in my ssh log I can't see that the user ever connected... ...
      (comp.unix.solaris)