iptables LOG and DROP in one rule

Although already over a year old, I stumbled across this question a couple of times on other Google search and I believe I can improve on the previous answer for the benefit of others.

Short answer is you cannot combine both action in one line, but you can create a chain that does what you want and then call it in a one liner.

Let’s create a chain to log and accept:

iptables -N LOG_ACCEPT

And let’s populate its rules:

iptables -A LOG_ACCEPT -j LOG --log-level 6 --log-prefix "INPUT:ACCEPT: "
iptables -A LOG_ACCEPT -j ACCEPT

Now let’s create a chain to log and drop:

iptables -N LOG_DROP

And let’s populate its rules:

iptables -A LOG_DROP -j LOG --log-level 6 --log-prefix "INPUT:DROP: "
iptables -A LOG_DROP -j DROP

Now you can do all actions in one go by jumping (-j) to you custom chains instead of the default LOG / ACCEPT / REJECT / DROP:

iptables -A <your_chain_here> <your_conditions_here> -j LOG_ACCEPT
iptables -A <your_chain_here> <your_conditions_here> -j LOG_DROP

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)