Logging denied packets (iptables)

Wednesday, 17 October 2007



    One of our offices has several network ranges blocked in iptables 
(essentially '-A INPUT -s www.xxx.yyy.zzz/aa -j DROP').  What I'd like 
to do is create a log entry each time a packet is dropped, IF it matches 
any of those networks.  I think I need to assign all of those networks 
to a "group" and then log dropped packets from that group only.  And 
while I realize this might have other ramifications, such as logs 
growing exponentially, for now we're taking small steps.  Later on I can 
then look for things like logging the same IP only once...

    So how do I tell iptables to create a group or name, or whatever 
it's called for those ranges, and then log dropped packets from those 
ranges only?  And to be quite honest, all I really care to see in the 
log is something like '[standard log prefix] Packet DROP: 
$source/$destination' (or $source-port/$destination-port) - I don't 
really care for the lengthy log entry that iptables creates, such as 
this example of an SSH-reject:

Oct 17 11:15:04 queenb kernel: SSH REJECT: IN=eth0 OUT= 
MAC=00:30:48:33:96:22:00:07:50:49:df:7a:08:00 SRC=124.198.16.156 
DST=207.174.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=38666 DF 
PROTO=TCP SPT=48226 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0