How to Log Dropped iptables Packets for Easy Troubleshooting

This article explains how to log incoming and outgoing dropped firewall packets using iptables, providing commands, configuration tips, and examples for reading the logs.

Logging all dropped inbound packets

First, add rules at the bottom of your existing iptables firewall to record all dropped inbound packets to /var/log/messages.

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

The commands perform the following actions:

Create a new chain named LOGGING .

Redirect all remaining inbound packets to the LOGGING chain.

Log the packets to syslog with a rate limit and a custom prefix.

Finally drop the packets.

Explanation of the logging options in the third rule: -m limit uses the limit match module to control logging frequency. --limit 2/min caps logs to two entries per minute. -j LOG sends the packet information to the log. --log-prefix "IPTables-Dropped: " adds a custom prefix to each log line. --log-level 4 sets the syslog severity to warning.

Logging all dropped outbound packets

The same approach applies to outbound traffic, replacing INPUT with OUTPUT in the second rule.

iptables -N LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

Logging both inbound and outbound dropped packets

Combine the inbound and outbound rules to log all dropped packets in a single configuration.

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

If you prefer a custom log file instead of the default /var/log/messages, add a line to /etc/syslog.conf such as:

kern.warning /var/log/custom.log

How to read iptables logs

Example log entries for dropped inbound and outbound packets recorded in /var/log/messages:

Aug 4 13:22:40 centos kernel: IPTables-Dropped: IN= OUT=em1 SRC=192.168.1.23 DST=192.168.1.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=59228 SEQ=2
Aug 4 13:23:00 centos kernel: IPTables-Dropped: IN=em1 OUT= MAC=a2:be:d2:ab:11:af:e2:f2:00:00 SRC=192.168.2.115 DST=192.168.1.23 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=9434 DF PROTO=TCP SPT=58428 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0

Key fields in the log lines:

IPTables-Dropped : the custom prefix defined with --log-prefix.

IN and OUT : network interfaces for inbound and outbound packets.

SRC and DST : source and destination IP addresses.

LEN : packet length.

PROTO : protocol (e.g., ICMP, TCP).

SPT and DPT : source and destination ports (for TCP/UDP).