title: Logging all connections using iptables to closed ports
body: <p>In FreeBSD, there is a kernel parameter tweakable via sysctl (net.inet.tcp.log_in_vain) that provides you with logs of attempted connections to ports which are not running a service (i.e. closed ports). These messages are logged to /var/log/messages (somewhat) in the following format:</p>
  
  <blockquote>
    <p>2014-06-26 13:18:58|218.77.79.43|58848|192.168.192.28|443|tcp_input: Connection attempt to closed port </p>
  </blockquote>
  
  <p>Without forwarding all connections from router to my FreeBSD box, I get these messages on a regular basis. How is this happening if I haven't explicitly created port-forward rulesets redirecting traffic to this box on the router?</p>
  
  <p>I'm looking to set up something similar using iptables, reducing as much noise as possible e.g. only see connections for those originating outside of my network as src and ignore any outgoing. </p>
  
  <p>I was attempting to use something like the following to do this:</p>
  
  <blockquote>
    <p>iptables -I INPUT -m state --state NEW -j LOG --log-prefix "New Connection: "  </p>
  </blockquote>
  
  <p>I'm pretty sure this syntax is fairly outdated. I come from an IPF world so I'm not quite up to speed with the latest iptables syntax conventions.</p>
  
  <p>This rule is generating the type of logs I'm looking for in /var/log/messages:</p>
  
  <blockquote>
    <p>Jun 28 00:38:12 kermit kernel: [ 6331.339928] New Connection: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:a8:86:dd:8a:c9:26:08:00:45:00:00:48:e8:3f:00:00:40:11:8f:ec │
    SRC=192.168.192.40 DST=192.168.192.255 LEN=72 TOS=0x00 PREC=0x00 TTL=64 ID=59455 PROTO=UDP SPT=57621 DPT=57621 LEN=52</p>
  </blockquote>
  
  <p>Thus far, I haven't seen any connections from outside of my own network. Additionally, I can see SSH login attempts in /var/log/auth.log which are not appearing in /var/log/messages using the above iptables rule:</p>
  
  <blockquote>
    <p>Jun 28 09:31:42 kermit sshd[10097]: pam_unix(sshd:auth): check pass; user unknown</p>
    
    <p>Jun 28 09:31:44 kermit sshd[10097]: Failed password for invalid user admin from 116.10.191.187 port 40312 ssh2  </p>
  </blockquote>
  
  <p>Is it possible using iptables to create the following:</p>
  
  <ol>
  <li>A rule/ruleset which logs all incoming connections to my box to /var/log/messages</li>
  <li>Don't log any connections originating from within my own network</li>
  <li>Don't log any outgoing connections</li>
  <li>Am I required to forward all connections on the router to my box in order to get similar log messages as I did in FreeBSD? (i.e. port-forward all ports)</li>
  </ol>