-A RH-Firewall-1-INPUT -m state --state NEW -j LOG --log-level warning --log-prefix "BLOCK " -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
It is very important to remember that, the rules will be read from top to down, if a connection is been accepted or rejected in the middle of the rules, rules below it will be ignore. That means if you put your log rule after reject rule, log action will not be take place. On the other hand, if you place infront of accept rule, you will log all the connection whether it success or failed.
I also wanna log down ssh connection, so i add ssh log rule infront of ssh accept rule
-A RH-Firewall-1-INPUT -p tcp --dport 22 -j LOG --log-level warning --log-prefix "SSH " -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
--log-level is used for me to indicate that the particular log must be recorded into another file by setting syslog.conf , will discuss later.
--log-prefix is used to inject wording infront of the log records, the purpose is to differenciate between block connection and ssh connection.
/etc/syslog.conf is a configuration file for log system daemon. All logging basically controls by syslogd, to manipulate which log goes to which file, we need to modified /etc/syslog.conf. I am not going to illustrate too much on what is syslog, you can always read up with "man syslog.conf"
The iptables log will goes to kern category of syslog, therefore to direct all iptables log to /var/log/iptables, edit /etc/syslog.conf with adding line bellow at somewhere:
For me I wounldn't like to dirty my /var/log/messages which it used to log all the system messages, so i modified the messages part into this:
*.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none;\ !kern.warning -/var/log/messages
I add in the line "!kern.warning", to indicate syslogd don't write the log of kern with level warning to messages.
After that, do 2 fin action and you are done.
/etc/syslogd restart /etc/iptables restart
Refers to http://my.opera.com/mysurface/blog/show.dml/289865 if you couldn't find iptables under /etc/init.d
p.s. : I donno why when I type dmesg, iptables log is still display. I tot dmesg reads from messages, it seems that I am wrong.
Disclamer: I do not take responsibily on the code above to be a right way, I just share my experience on iptables, do it at your own risk.