Results 1 to 5 of 5
  1. #1
    Join Date
    Jul 2012
    Posts
    3
    Thanks
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Question iptables: log connection after SNAT/MASQUERADE command

    Hello!

    I have the following problem with iptables in Debian 6:

    My server works as a router and it needs to log server external IP+port for all outgoing connections.

    But after command SNAT or MASQUERADE traffic is "lost".
    I mean no following rules can catch those traffic.
    Everything looks like SNAT/MASQUERADE is the "end" rule and it pushes traffic to network immediately.

    Question:

    How can I log routed connection data with server external IP and port?




  2. #2
    Join Date
    Aug 2012
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Hello,

    Have you tried to sniff traffic with tcpdump over the outgoing interface to check if really traffic ends on that rules?

    Regards.

  3. #3
    Join Date
    Jul 2012
    Posts
    3
    Thanks
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0
    What should I see in TCP dump?
    Packets are not lost. They just don't applied to the rest of firewall rules.

    And I have found a solutions using conntrack.
    The following command shows all new tcp connections in real time:
    conntrack -E -o timestamp -p tcp -e NEW

    This command shows full information about routed connections: source IP+port, NAT IP+port, destination IP+port.

    I just execute it in background and redirect output to log:
    conntrack -E -o timestamp -p tcp -e NEW 2>&1 >> /var/log/tcp_connections &
    conntrack -E -o timestamp -p udp -e NEW 2>&1 >> /var/log/udp_connections &

    I also created a simple script to start/stop these processes and added it to run at startup.
    Last edited by unlimited; 08-25-2012 at 04:57 PM.

  4. The Following User Says Thank You to unlimited For This Useful Post:

    Akendo (08-27-2012)

  5. #4
    Join Date
    Feb 2012
    Location
    Europe
    Posts
    138
    Thanks
    4
    Thanked 6 Times in 5 Posts
    Rep Power
    2
    Hey, great. I din't know that Tool. Thanks
    Feel free to follow my blog.

  6. #5
    Join Date
    Jul 2012
    Posts
    3
    Thanks
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0
    I have an update for my solution.
    If you have a lot of connections - conntrack may stop logging.
    Usually it gets error about not enough network buffers (ENOBUFS).

    Using "-b 10485760" switch helped in my case.

    WARNING: We have hit ENOBUFS! We are losing events.
    This message means that the current netlink socket buffer size is too small.
    Please, check --buffer-size in conntrack(8) manpage.
    conntrack v0.9.14 (conntrack-tools): Operation failed: No buffer space available

 

 

Similar Threads

  1. Replies: 1
    Last Post: 09-11-2012, 06:54 AM
  2. Log Analysis
    By MustangV10 in forum Server Security
    Replies: 3
    Last Post: 05-02-2012, 09:20 AM
  3. Replies: 1
    Last Post: 03-27-2012, 08:55 PM
  4. Nightly clamav error: duplicate log entry
    By Rob in forum Mail Server
    Replies: 0
    Last Post: 01-11-2012, 10:27 AM
  5. Replies: 0
    Last Post: 12-14-2011, 07:00 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
           








Check out Linux Central for Linux software and other goodies!





» Stats

Members: 3,590
Threads: 3,921
Posts: 9,452
Top Poster: Fred (1,486)
Welcome to our newest member, Pejii

» Links



Powered by vBadvanced CMPS