Centos – log connection attempts from an IP blocked by iptables

centosiptables

I blocked an abusive IP from a CentOS server using iptables, dropping all connection attempts on all services / ports.

As is the way of things, the server with this IP may have been part of a botnet, and may have been cleaned in the time since I blocked it. I would like to find out if it's still trying to attack the server, so I can decide whether to unblock the IP… without unblocking it first.

I have tried searching through /var/log for anything that looks like iptables, grepped /var/log/secure for the offending IP, but have turned up nothing.

Is there a log of dropped connection attempts for iptables, or a way to configure the rule to log attempts but still drop them?

Best Answer

In addition to the other answers, iptables -v -L lists the counts of packets and bytes that traverse a given rule, so you can see how much traffic you're dropping, and I wouldn't be too hard to write a tool that parses and reports that info.

Related Solutions

What tool to execute a command on repeated syslog entries

I'd recommend fail2ban.

Fail2ban is software which is meant to monitor logs for brute force login attempts. When it see's such an attempt, it blocks the attacker's IP via iptables. After a sufficient amount of time has passed fail2ban will automatically remove the block.

Fail2ban is customizable and can work with just about any type of internet service daemon. There is even specific documentation for pop3 daemons such as courier, dovecot, and qmail.

Record contents of packets dropped in iptables

The NFLOG target can be used for this purpose. Here is a very basic example:

# Drop traffic by default
iptables -P INPUT DROP

# add your whitelists here
# iptables -A INPUT ...

# Pass the packets to NFLOG (just like LOG, but instead of syslog,
# it uses netlink). You can add extra filters such as '-p tcp' as usual
iptables -A INPUT -j NFLOG
# packets that get here will now be dropped per INPUT policy

# Finally you can use tcpdump to capture from this interface (there
# can only be one active user of nflog AFAIK)
tcpdump -i nflog ...

Refer to the iptables-extensions manual page for a description of the NFLOG target.

Best Answer

Related Solutions

What tool to execute a command on repeated syslog entries

Record contents of packets dropped in iptables

Related Question