title: Logging Dropped Packets in IPTables?
body: <p>I'm trying to log some dropped packets in iptables from a malicious IP Address that keeps hitting my server.</p>
  
  <p>Everything that comes from this malicious IP is dropped and I don't see it in the web server logs anymore which is a good thing. Using tcpdump, I can see traffic still coming from this IP, and I would like to log the dropped packets in iptables, since I know it's working and they are being dropped.</p>
  
  <p>I have some iptables rules, and I don't know why the logging is not working. I'm sure I'm missing something.</p>
  
  <p>-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</p>
  
  <p>-A INPUT -i lo -j ACCEPT</p>
  
  <p>-A INPUT -m state --state INVALID -j DROP</p>
  
  <p>-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP</p>
  
  <p>-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP</p>
  
  <p><strong>-A INPUT -s 80.82.65.0/24 -j DROP</strong></p>
  
  <p>-A INPUT -s 167.74.0.0/18 -j DROP</p>
  
  <p>-A INPUT -s 167.87.0.0/16 -j DROP</p>
  
  <p>-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT</p>
  
  <p>-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT</p>
  
  <p>-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</p>
  
  <p>-A INPUT -j LOGGING</p>
  
  <p>-A FORWARD -m state --state INVALID -j DROP</p>
  
  <p>-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT</p>
  
  <p>-A OUTPUT -m state --state INVALID -j DROP</p>
  
  <p>-A LOGGING -s 80.82.65.0/24 -m limit --limit 5/min -j LOG --log-prefix "iptables dropped packets " --log-level 7</p>
  
  <p>$ grep iptables /etc/rsyslog.conf </p>
  
  <p>kern.debug                      /var/log/iptables.log</p>