Iptables logs and limit parameters

When handling work problems, you need to view the firewall logs, because the default logs are in the system logs/var/log/messages. You need to configure rsyslog.

First, edit the configuration file/etc/rsyslog. conf as follows:

# Log all kernel messages to the console. # logging much else clutters up the screen. # Kern. */dev/console # log anything (same T mail) of level info or higher. # Don't log private authentication messages! *. Info; mail. none; authpriv. none; cron. none/var/log/messages # The authpriv file has restricted access. authpriv. */var/log/secure # log all the mail messages in one place. mail. *-/var/log/maillog # log cron stuffcron. */var/log/cron # Everybody gets emergency messages *. emerg * # Save news errors of level crit and higher in a special file. uucp, news. crit/var/log/Spooler # Save boot messages also to boot. loglocal7. */var/log/boot. log # keepalived-s 0local0. */var/log/keepalived. log # iptableskern. warning/var/log/iptables. log # Add item #### begin forwarding rule ###

Then, follow the instructions on iptables to add parameters to start log.

Iptables default log filefor example, if you type the following command, it will display current iptables log from/var/log/messages file: # tail-F/var/log/messages output: oct 4 01:14:19 Debian kernel: In = ra0 out = MAC = 00: 17: 9A: 0a: F6: 44: 00: 08: 5C: 00: 00: 01: 08: 00 src = 200.142.84.36 DST = 192.168.1.2 Len = 60 TOS = 0x00 prec = 0x00 TTL = 51 id = 18374 DF proto = tcp spt = 46040 DPT = 22 window = 5840 res = 0x00 SYN urgp = 0 Oct 4 00:13:55 Debian kernel: in = ra0 out = MAC = FF: 00: 18: de: 55: 0a: 56: 08: 00 src = 192.168.1.30 DST = 192.168.1.255len = 78 TOS = 0x00 prec = 0x00 TTL = 128 id = 13461 proto = udp spt = 137 DPT = 137 Len = 58 procedure to log the iptables messages to a different log file open your/etc/syslog. CONF file: # vi/etc/syslog. conf append following line: Kern. warning/var/log/iptables. logsave and close the file. restart the syslogd (Debian/Ubuntu Linux): #/etc/init. d/sysklogd restart on the other hand, use following command to restart syslogd under Red Hat/cent OS/Fedora Core Linux: #/etc/init. d/syslog restart now make sure you pass the log-Level 4 option with log-prefix to iptables. for example: # Drop everything and log it iptables-A input-J log -- log-Level 4 iptables-A input-J Drop for example, drop and log all connections from IP address 64.55.11.2 to your/var/log/iptables. log File: iptables-A input-s 64.55.11.2-m limit -- limit 5/m -- limit-burst 7-J log -- log-Prefix '** hackers **' -- log-Level 4 iptables -A input-s 64.55.11.2-J Drop where, * -- log-Level 4: Level of logging. the level #4 is for warning. * -- log-Prefix '*** text ***': prefix log messages with the specified prefix (text); up to 29 letters long, and useful for distinguishing messages in the logs. you can now see all iptables message logged to/var/log/iptables. log File: # tail-F/var/log/iptables. log example: iptables-T Nat-A postrouting-s 192.168.10.128/25-O eht0-J masqueradeiptables-a forward-p tcp-J log -- log-level info -- log-TCP-optinosiptables -A input-I eth0-P TCP-J log -- log-level info -- log-prefix "iptables TCP-IN:"

Translation:

Open your/etc/syslog. CONF file: # vi/etc/syslog. conf adds the following line of information to the end of the file Kern. warning/var/log/iptables. log to save and close files. restart syslogd (if you use Debian/Ubuntu Linux): #/etc/init. d/sysklogd restart In addition, run the following command to restart syslogd (if you use red hat/cent OS/Fedora Core Linux): #/etc/init. d/syslog restart now make sure that your iptables uses the log-Level 4 parameter (there is a log-Prefix flag before ). for example: # Drop everything and log itiptables-A input-J log-Level 4 iptables-A input-J Drop. For example, discard and record all connection information from the IP address 65.55.11.2 to/var/log/iptables. log File. iptables-A input-s 64.55.11.2-m limit -- limit 5/m -- limit-burst 7-J log-Prefix '** hackers **' -- log-Level 4 iptables -A input-s 64.55.11.2-J Drop command explanation :. -Log-Level 4: record level. level 4 is warning ).. -Log-Prefix '*** text **': the prefix of text is defined before the log output information. text Information can contain a maximum of 29 characters, so that you can easily find relevant information in the record file. now you can use/var/log/iptables. for more information about the log file, see iptables: # tail-F/var/log/iptables. log

Actual command

iptables -I INPUT -s 116.3.248.157 -m limit --limit 5/m --limit-burst 5 -j LOG --log-prefix "***TEXT***" --log-level 4
iptables -I INPUT -p tcp --dport 18999 -j ACCEPT

-M -- limit command is used to limit the pass generated per minute. -- limit-burst 5 sets the pass limit. For example, if there are a total of five passes, the pass will be allowed. Otherwise, the pass will only be generated again. The generation limit is also 5, and cannot exceed 5.

Here, limit is used to prevent excessive screen flushing of logs, or to prevent DDoS attacks.

I saw an article explaining the image as follows:

The limit match operation must be explicitly specified by-m limit before it can be used. With his help, you can limit the number of logs of a specified rule, so that you are not overwhelmed by the flood of information. For example, you can set a limit value in advance. If the number of packages that meet the condition does not exceed the limit value, the record will be recorded. If the limit value is exceeded, the record will not be recorded. We can control the number of matching times (that is, the number of packages that can be matched) of a rule within a period of time to reduce the impact of dos syn flood attacks. This is his main role, of course, there are many other roles (Note: for example, for some of the less commonly used services, you can limit the number of connections to avoid affecting other services ). Limit match can also be reversed with an English exclamation point, such as-m limit! -- Limit 5/s indicates that after the quantity exceeds the limit value, all packages will be matched. Limit MATCH works like a security guard at the gate of an organization. When someone wants to enter, he needs to get a pass from him. When I go to work in the morning, the security guard has a certain number of passes in his hands. When I come to a person, I will issue one. When the pass is used up, the other person will not be able to enter, but they will not wait, but to other places (in iptables, this is equivalent to a package that does not comply with a certain rule, it will be handled by the following rules. If none of them comply, is handled by the Default policy ). However, there is a rule that the security guard will issue a new pass at intervals. In this way, if the people coming later happen to catch up, they will be able to get in. If no one will come, the pass will be retained for future use. If no one has ever been there, the number of available passes will increase, but not infinitely increasing. At most, that is, the number of security guards at the beginning. That is to say, the number of passes is limited at the beginning, but new passes are available at intervals. Limit match has two parameters, which correspond to this situation. -- limit-burst specifies the number of passes Available at the beginning, and -- limit specifies how long it takes to issue a new pass. It should be noted that here I emphasize "issuing a new Pass", which is based on iptables. When writing rules by yourself, you must consider this. For example, if you specify -- limit 3/minute -- limit-burst 5, five passes are allowed at the beginning, add one value every 20 seconds after use (this is from the perspective of iptables, but from the perspective of users, it means three more per minute or only three more per minute ). If you want to spend one time every 20 minutes, you can only write it as -- limit 3/hour -- limit-burst 5, which means you need to consolidate the time unit. Table 1? 1. limit match optionsmatch -- limitexampleiptables-A input-m limit -- limit 3/hourexplanation sets the maximum average matching rate for limit match, that is, limit match can match several packets per unit time. The format is a value plus a time unit, which can be/Second/minute/hour/day. The default value is 3 times per hour (User angle), that is, 3/hour, that is, once every 20 minutes (iptables angle ). Match -- limit-burstexampleiptables-A input-m limit -- limit-burst 5explanation the limit match peak value is defined in the unit time (this time is specified by -- limit above) A maximum of several packages can be matched within (it can be seen that the value of -- limit-burst is greater than that of -- limit ). The default value is 5. Assume the following rules: iptables-A input-p icmp-m limit -- limit 6/m -- limit-burst 5-J acceptiptables-P input drop and ping the host from another host, first, we can see that the responses from the first four packages are normal. Then, starting from the fifth package, we can receive a normal response every 10 seconds. This is because we have set the number of data packets allowed to pass per minute per unit time (in this example, every 10 seconds) to six; secondly, we set the event trigger threshold to 5, so the first four packages are normal, but the restriction rules take effect from the fifth package, therefore, only one normal response can be received every 10 seconds. Suppose we stop the Ping and start the ping 30 seconds later. The phenomenon is: the first two packets are normal and packet loss starts from the third packet, this is because here I allow a packet to pass through the cycle of 10 seconds, if the system does not receive a qualified package within a cycle, the system's trigger value will be restored to 1, therefore, if no eligible package passes through within 30 seconds, the trigger value of the system will be restored to 3. If no eligible package passes in five cycles, the value triggered by the system is completely restored.
For more information about iptables, see:
Linux iptables application manual (-):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4595.shtml
Linux iptables application manual (2 ):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4596.shtml
Linux iptables application manual (III ):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4597.shtml
Linux iptables application manual (4 ):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4598.shtml
Linux iptables application manual (5 ):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4599.shtml
Linux iptables application manual (6 ):
Http://fanqiang.chinaunix.net/system/linux/2006-06-20/4600.shtml

For more information, see iptables. for example: Comment (Remarks matching), string (string matching, can be used for content filtering), iprang (IP Range matching), time (time matching), ipp2p (Point-to-Point Matching ), connlimit (number of connections matching at the same time), Nth (nth packet matching), and geoip (matching by country or region ). ipp2p (Point-to-Point Matching) and quota (quota matching). For more information, see:
Http://bbs.chinaunix.net/viewthread.php? Tid = 525493

 

Iptables logs and limit parameters