iptables日志记录访问记录

最新推荐文章于 2025-05-16 17:48:32 发布

free操盘手

最新推荐文章于 2025-05-16 17:48:32 发布

阅读量1.3w

点赞数 1

CC 4.0 BY-SA版权

分类专栏： linux安全

本文链接：https://blog.youkuaiyun.com/curiouswen/article/details/78169119

linux安全专栏收录该内容

15 篇文章

订阅专栏

本文介绍了如何通过编辑/etc/sysconfig/iptables配置文件，添加特定规则来记录iptables的访问记录。通过在INPUT链中添加LOG规则，设置日志前缀和级别，可以将网络流量日志输出到/var/log/messages。同时，提到了可以通过修改rsyslog.conf文件来定制日志存储位置，并重启日志服务以使更改生效。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

/etc/sysconfig/iptables文件
# Generated by iptables-save v1.4.21 on Fri Aug 19 03:08:01 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [57:10495]
:NEW_PORT - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.10.0/24 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -j NEW_PORT
-A INPUT -j LOG --log-prefix "curious_log " --log-level 6
-A INPUT -j DROP
-A NEW_PORT -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A NEW_PORT -p tcp -m multiport --dports 22 -j ACCEPT
-A NEW_PORT -j RETURN
COMMIT
# Completed on Fri Aug 19 03:08:01 2016

打开iptables日志只需添加一条规则
-A INPUT -j LOG --log-prefix "curious_log " --log-level 6 //输出日志在/var/log/messages

日志级别说明：

The kernel log levels are:

0 (KERN_EMERG)

The system is unusable.

1 (KERN_ALERT)

Actions that must be taken care of immediately.

2 (KERN_CRIT)

Critical conditions.

3 (KERN_ERR)

Noncritical error conditions.

4 (KERN_WARNING)

Warning conditions that should be taken care of.

5 (KERN_NOTICE)

Normal, but significant events.

6 (KERN_INFO)

Informational messages that require no action.

7 (KERN_DEBUG)

Kernel debugging messages, output by the kernel if the developer enabled debugging at compile time.