blocks|key|154573|text|示例：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|154574|iptables+-A+INPUT+-j+LOG+--log-prefix+"INPUT:DROP:"+--log-level+6
iptables+-A+INPUT+-j+DROP|code-block|syntax|javascript|154575|日志示例：|154576|Feb+19+14:18:06+servername+kernel:+INPUT:DROP:IN=eth1+OUT=+MAC=aa:bb:cc:dd:ee:ff:11:22:33:44:55:66:77:88+SRC=x.x.x.x+DST=x.x.x.x+LEN=48+TOS=0x00+PREC=0x00+TTL=117+ID=x+PROTO=TCP+SPT=x+DPT=x+WINDOW=x+RES=0x00+SYN+URGP=0|154577|其他选项：|154578|+++LOG
+++++++Turn+on+kernel+logging+of+matching+packets.++When+this+option+
+++++++is+set+for+a+rule,+the+Linux+kernel+will+print+some+
+++++++information++on++all++matching++packets
+++++++(like+most+IP+header+fields)+via+the+kernel+log+(where+it+can+
+++++++be+read+with+dmesg+or+syslogd(8)).++This+is+a+"non-terminating+
+++++++target",+i.e.+rule+traversal
+++++++continues+at+the+next+rule.++So+if+you+want+to+LOG+the+packets+
+++++++you+refuse,+use+two+separate+rules+with+the+same+matching+
+++++++criteria,+first+using+target+LOG
+++++++then+DROP+(or+REJECT).

+++++++--log-level+level
++++++++++++++Level+of+logging+(numeric+or+see+syslog.conf(5)).

+++++++--log-prefix+prefix
++++++++++++++Prefix+log+messages+with+the+specified+prefix;+up+to+29+
++++++++++++++letters+long,+and+useful+for+distinguishing+messages+in+
++++++++++++++the+logs.

+++++++--log-tcp-sequence
++++++++++++++Log+TCP+sequence+numbers.+This+is+a+security+risk+if+the+
++++++++++++++log+is+readable+by+users.

+++++++--log-tcp-options
++++++++++++++Log+options+from+the+TCP+packet+header.

+++++++--log-ip-options
++++++++++++++Log+options+from+the+IP+packet+header.

+++++++--log-uid
++++++++++++++Log+the+userid+of+the+process+which+generated+the+packet.|154579|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

Example:

<pre><code>iptables -A INPUT -j LOG --log-prefix "INPUT:DROP:" --log-level 6
iptables -A INPUT -j DROP
</code></pre>

Log Exampe:

<pre><code>Feb 19 14:18:06 servername kernel: INPUT:DROP:IN=eth1 OUT= MAC=aa:bb:cc:dd:ee:ff:11:22:33:44:55:66:77:88 SRC=x.x.x.x DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=x PROTO=TCP SPT=x DPT=x WINDOW=x RES=0x00 SYN URGP=0
</code></pre>

Other options:

<pre><code> LOG
 Turn on kernel logging of matching packets. When this option 
 is set for a rule, the Linux kernel will print some 
 information on all matching packets
 (like most IP header fields) via the kernel log (where it can 
 be read with dmesg or syslogd(8)). This is a "non-terminating 
 target", i.e. rule traversal
 continues at the next rule. So if you want to LOG the packets 
 you refuse, use two separate rules with the same matching 
 criteria, first using target LOG
 then DROP (or REJECT).

 --log-level level
 Level of logging (numeric or see syslog.conf(5)).

 --log-prefix prefix
 Prefix log messages with the specified prefix; up to 29 
 letters long, and useful for distinguishing messages in 
 the logs.

 --log-tcp-sequence
 Log TCP sequence numbers. This is a security risk if the 
 log is readable by users.

 --log-tcp-options
 Log options from the TCP packet header.

 --log-ip-options
 Log options from the IP packet header.

 --log-uid
 Log the userid of the process which generated the packet.
</code></pre>

blocks|key|154682|text|虽然已经有一年多的时间了，但我在其他谷歌搜索上偶然发现了这个问题几次，我相信我可以改进之前的答案，为其他人带来好处。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|154683|简而言之，您不能将这两个操作组合在一行中，但您可以创建一个链来做您想做的事情，然后在一个一行中调用它。|154684|让我们创建一个链来记录和接受：|154685|iptables+-N+LOG_ACCEPT|code-block|syntax|javascript|154686|让我们填充它的规则：|154687|iptables+-A+LOG_ACCEPT+-j+LOG+--log-prefix+"INPUT:ACCEPT:"+--log-level+6
iptables+-A+LOG_ACCEPT+-j+ACCEPT|154688|现在，让我们创建一个链来记录和删除：|154689|iptables+-N+LOG_DROP|154690|154691|iptables+-A+LOG_DROP+-j+LOG+--log-prefix+"INPUT:DROP:+"+--log-level+6
iptables+-A+LOG_DROP+-j+DROP|154692|现在，您可以通过跳转(-j)到您的自定义链，而不是默认的日志/接受/拒绝/丢弃，一次性完成所有操作：|154693|iptables+-A+<your_chain_here>+<your_conditions_here>+-j+LOG_ACCEPT
iptables+-A+<your_chain_here>+<your_conditions_here>+-j+LOG_DROP|154694|entityMap^0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|13|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|14|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|15|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|16|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|17|8|@]|9|@]|A|$]]|$1|Q|3|R|5|H|7|18|8|@]|9|@]|A|$I|J]]|$1|S|3|L|5|6|7|19|8|@]|9|@]|A|$]]|$1|T|3|U|5|H|7|1A|8|@]|9|@]|A|$I|J]]|$1|V|3|W|5|6|7|1B|8|@]|9|@]|A|$]]|$1|X|3|Y|5|H|7|1C|8|@]|9|@]|A|$I|J]]|$1|Z|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]]|10|$]]

Although already over a year old, I stumbled across this question a couple of times on other Google search and I believe I can improve on the previous answer for the benefit of others.

Short answer is you cannot combine both action in one line, but you can create a chain that does what you want and then call it in a one liner.

Let's create a chain to log and accept:

<pre><code>iptables -N LOG_ACCEPT
</code></pre>

And let's populate its rules:

<pre><code>iptables -A LOG_ACCEPT -j LOG --log-prefix "INPUT:ACCEPT:" --log-level 6
iptables -A LOG_ACCEPT -j ACCEPT
</code></pre>

Now let's create a chain to log and drop:

<pre><code>iptables -N LOG_DROP
</code></pre>

And let's populate its rules:

<pre><code>iptables -A LOG_DROP -j LOG --log-prefix "INPUT:DROP: " --log-level 6
iptables -A LOG_DROP -j DROP
</code></pre>

Now you can do all actions in one go by jumping (-j) to you custom chains instead of the default LOG / ACCEPT / REJECT / DROP:

<pre><code>iptables -A &lt;your_chain_here&gt; &lt;your_conditions_here&gt; -j LOG_ACCEPT
iptables -A &lt;your_chain_here&gt; &lt;your_conditions_here&gt; -j LOG_DROP
</code></pre>

blocks|key|154731|text|对于中国GFW：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|154732|sudo+iptables+-I+INPUT+-s+173.194.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+DROP
sudo+iptables+-I+INPUT+-s+173.194.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+LOG+--log-prefix+"drop+rst"

sudo+iptables+-I+INPUT+-s+64.233.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+DROP
sudo+iptables+-I+INPUT+-s+64.233.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+LOG+--log-prefix+"drop+rst"

sudo+iptables+-I+INPUT+-s+74.125.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+DROP
sudo+iptables+-I+INPUT+-s+74.125.0.0/16+-p+tcp+--tcp-flags+RST+RST+-j+LOG+--log-prefix+"drop+rst"|code-block|syntax|javascript|154733|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

for china GFW:

<pre><code>sudo iptables -I INPUT -s 173.194.0.0/16 -p tcp --tcp-flags RST RST -j DROP
sudo iptables -I INPUT -s 173.194.0.0/16 -p tcp --tcp-flags RST RST -j LOG --log-prefix "drop rst"

sudo iptables -I INPUT -s 64.233.0.0/16 -p tcp --tcp-flags RST RST -j DROP
sudo iptables -I INPUT -s 64.233.0.0/16 -p tcp --tcp-flags RST RST -j LOG --log-prefix "drop rst"

sudo iptables -I INPUT -s 74.125.0.0/16 -p tcp --tcp-flags RST RST -j DROP
sudo iptables -I INPUT -s 74.125.0.0/16 -p tcp --tcp-flags RST RST -j LOG --log-prefix "drop rst"
</code></pre>

blocks|key|154816|text|nflog更好|type|unstyled|depth|inlineStyleRanges|entityRanges|data|154817|sudo+apt-get+-y+install+ulogd2|code-block|syntax|javascript|154818|ICMP阻止规则示例：|154819|iptables=/sbin/iptables
#+Drop+ICMP+(PING)
$iptables+-t+mangle+-A+PREROUTING+-p+icmp+-j+NFLOG+--nflog-prefix+'ICMP+Block'
$iptables+-t+mangle+-A+PREROUTING+-p+icmp+-j+DROP|154820|你可以在日志中搜索前缀"ICMP+Block“：|154821|/var/log/ulog/syslogemu.log|154822|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

nflog is better

<pre><code>sudo apt-get -y install ulogd2
</code></pre>

ICMP Block rule example:

<pre><code>iptables=/sbin/iptables
# Drop ICMP (PING)
$iptables -t mangle -A PREROUTING -p icmp -j NFLOG --nflog-prefix 'ICMP Block'
$iptables -t mangle -A PREROUTING -p icmp -j DROP
</code></pre>

And you can search prefix "ICMP Block" in log:

<pre><code>/var/log/ulog/syslogemu.log
</code></pre>

I am trying to log outgoing connections with iptables. What I want is, drop and accept connection while logging them also. I have found that -j option takes DROP/REJECT/ACCEPT/LOG. But I want to do something like DROP and LOG or ACCEPT and LOG. Is there a way to achieve this ?

iptables LOG and DROP in one rule

Linux

ICMP

我正在尝试使用iptables记录传出连接。我想要的是，放弃并接受连接，同时也记录它们。我发现-j选项采用DROP/REJECT/ACCEPT/LOG。但是我想做一些像DROP和LOG或者ACCEPT和LOG这样的事情。有没有办法做到这一点？

问iptables在一个规则中记录和删除
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问iptables在一个规则中记录和删除EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问iptables在一个规则中记录和删除
EN