Skip to content

Update iptables.cpp#5

Open
ukrolelo wants to merge 1 commit intotower9:masterfrom
ukrolelo:master
Open

Update iptables.cpp#5
ukrolelo wants to merge 1 commit intotower9:masterfrom
ukrolelo:master

Conversation

@ukrolelo
Copy link

When using default drop policy with logging,the rule is going bellow and the log doesnt apear. with changed -I it is going above, so seperate loging for hostblock and seperate for IPs that were not blocked yet. If its okay with your script logic? Or you are reading the same rules and adding the scores?

When using default drop policy with loggin,the rule is going bellow and the log doesnt apear. with changed -I it is going above, so seperate loging for hostblock and seperate for IPs that were not blocked yet.
@ukrolelo
Copy link
Author

ukrolelo commented Sep 10, 2021

For future refference. To seperate the logging.
nano /etc/rsyslog.d/iptables.conf
:msg, contains, "IPTABLES-DROPPED: " -/var/log/hostblock.log
& stop
:msg, contains, "PORT-SCAN-DROPPED: " -/var/log/hostblock.log
& stop
:msg, contains, "[DROP] " -/var/log/iptables.log
& stop


nano /etc/rsyslog.conf
auth,authpriv.* /var/log/auth.log
.;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant