CentOS iptables 记录指定IP的网络访问日志

CentOS iptables 记录指定IP的网络访问日志

1.修改记录级别及位置 

vi /etc/rsyslog.conf

kern.*  /var/log/iptables.conf

2.指定要记录的IP

iptables -t mangle -A POSTROUTING  -d xxxxx  -s xxxxx -j LOG --log-level info

 

3.重启服务

service rsyslog restart

service iptables restart

 

监控不同的内容如：

https://blog.csdn.net/u010278923/article/details/69427246?depth_1-utm_source=distribute.pc_relevant.none-task&utm_source=distribute.pc_relevant.none-task

iptables -t raw -I OUTPUT -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "raw out: "
iptables -t mangle -I OUTPUT -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "mangle out: "
iptables -t nat -I OUTPUT -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "nat out: "
iptables -t filter -I OUTPUT -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "filter out: "
iptables -t mangle -I POSTROUTING -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "mangle post: "
iptables -t nat -I POSTROUTING -d 10.254.51.153 -j LOG --log-level 7 --log-prefix "nat post: "

iptables -t raw -I OUTPUT -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "raw out: "
iptables -t mangle -I OUTPUT -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "mangle out: "
iptables -t nat -I OUTPUT -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "nat out: "
iptables -t filter -I OUTPUT -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "filter out: "
iptables -t mangle -I POSTROUTING -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "mangle post: "
iptables -t nat -I POSTROUTING -d 192.168.67.4 -j LOG --log-level 7 --log-prefix "nat post: "

iptables -t raw -I OUTPUT -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "raw out: "
iptables -t mangle -I OUTPUT -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "mangle out: "
iptables -t nat -I OUTPUT -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "nat out: "
iptables -t filter -I OUTPUT -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "filter out: "
iptables -t mangle -I POSTROUTING -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "mangle post: "
iptables -t nat -I POSTROUTING -d 10.39.0.7 -j LOG --log-level 7 --log-prefix "nat post: "