Re: [iptables] How to both DROP and LOG

From: Mark Newby (mark.newby@ntlworld.com)
Date: 05/19/02 

From: Mark Newby <mark.newby@ntlworld.com>
Date: Sun, 19 May 2002 17:58:19 +0100

Harry Putnam wrote:
> Can a single iptables rule be given that will both DROP and LOG attempted
> connections?
>
> Or must it be done like below?
> iptables -I FORWARD -s $host -j DROP
>
> iptables -I FORWARD -s $host -j LOG
>

it has to be the other way around. when you -j LOG, the packet
continues through the chain, so the next one should be -j DROP.

personally, I've got these two as the last two rules in each of my
chains, but Luke's advice to create a dedicated rule that LOGs then
DROPs to be used wherever needed keeps things neeter.

mark

Relevant Pages

  • Re: [iptables] How to both DROP and LOG
    ... Harry Putnam wrote: ... > Can a single iptables rule be given that will both DROP and LOG attempted ... Remove NOSPAM from my return address if necessary ...
    (comp.os.linux.security)
  • Re: [iptables] How to both DROP and LOG
    ... Harry Putnam wrote: ... > Can a single iptables rule be given that will both DROP and LOG attempted ... Remove NOSPAM from my return address if necessary ...
    (comp.os.linux.security)
  • Re: [iptables] How to both DROP and LOG
    ... Harry Putnam wrote: ... > Can a single iptables rule be given that will both DROP and LOG attempted ... continues through the chain, so the next one should be -j DROP. ...
    (comp.os.linux.security)
  • Re: ERROR:iMPACT:585
    ... You should also run iMPACT in interactive GUI mode and build the chain manually. ... I can download the design using the compact flash but with JTAG it gives a problem. ... Check that the cable, scan chain, and power connections are intact, that the specified scan chain configuration matches the actual hardware, and that the power supply is adequate and delivering the correct voltage. ...
    (comp.arch.fpga)
  • Re: iptables
    ... According to RFC 793 the correct handling will in most cases be ... For the OUTPUT chain the --state NEW! ... connections when the firewall is started. ... But if you DROP them the connections can be hanging ...
    (comp.os.linux.security)
Quantcast