Path: csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!postnews.google.com!news2.google.com!newsfeed2.dallas1.level3.net!news.level3.com!panix!panix.com!ddellutr From: Dale Dellutri Newsgroups: comp.os.linux.networking Subject: Re: DMZ for logging Date: Mon, 30 Jan 2012 15:35:08 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 54 Message-ID: References: <87mx95st8m.fsf@newsguy.com> NNTP-Posting-Host: panix1.panix.com X-Trace: reader1.panix.com 1327937708 5382 166.84.1.1 (30 Jan 2012 15:35:08 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Mon, 30 Jan 2012 15:35:08 +0000 (UTC) User-Agent: tin/1.8.3-20070201 ("Scotasay") (UNIX) (NetBSD/5.1 (i386)) Xref: x330-a1.tempe.blueboxinc.net comp.os.linux.networking:1026 On Sun, 29 Jan 2012 23:35:05 -0500, Harry Putnam wrote: > I hope to find experienced iptables users here who can tell me if this > idea is something I could setup with iptables. > I'd like to get a real good idea of what is coming at me from the > internet. Is there a technique where all incoming connections are > copied to a separate server that uses iptables to sort categorize and > log incoming traffic, but then drops it. At least the portion that is > at all suspect in any way. > After a while I would start to know what is just taking up log space > for no good reason and what is actually something likely to be > malicious in intent. > I want a first hand look at what comes down the pipe. You can easily set up a log-before-drop rule using iptables itself, and the logging then goes to wherever syslog sends kernel messages (typically, on the machine running iptables). For example, on my firewalls, the default rule for the INPUT chain is drop: # Default policy: DROP /sbin/iptables -P INPUT DROP and then I have rules to accept all the traffic I want, and finally a rule to log any traffic that remains (thus, unwanted): # Log all else before default DROP # (Perhaps add "-m limit" before -j LOG?) /sbin/iptables -A INPUT -j LOG --log-prefix "iptables INPUT: " Then, since the default policy is DROP, the packet is dropped. In my case, the logging is done to /var/log/messages, for example: Jan 29 20:17:24 kernel: iptables INPUT: IN=eth1 OUT= MAC= SRC= DST= LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=61372 DF PROTO=TCP SPT=3091 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 I have logwatch running, and I get daily messages summarizing all of the dropped messages, for example: Logged 65 packets on interface eth1 From - 1 packet to udp(5060) From - 1 packet to udp(5060) From - 5 packets to tcp(135) ... So I have a good idea of which ip addresses are trying to get in using whatever kinds of packets. I also have logrotate running, so I keep 4 weeks worth of /var/log/messages. (The actual ip and mac addresses have been replaced with and in the notes above.) I don't see why you need a DMZ machine for this. -- Dale Dellutri (lose the Q's)