Dear Juan, see the section on logging in the wiki: https://wiki.archlinux.org/index.php/Iptables#Logging Cheers Bastian On Sun, Aug 26, 2012 at 7:11 PM, Juan Diego Tascón wrote:

Thanks for both replies. The graphic does it a lot more understandable. Is there any way to debug iptables, I mean, like a tool where I can visualize the path of a packet and where exactly it gets dropped/accepted and also realtime packets headers (src, dst, proto, dport, sport, etc)?

On Sat, Aug 25, 2012 at 12:56 PM, Corrado Primier wrote:

...

2012/8/25 Juan Diego Tascón :

...

Good day,

Hello :)

...

I'm thinking of setting the default FORWARD policy to ACCEPT as my default INPUT policy is DROP and unless there is a valid FORWARD rule for a given port the packets wont go anywhere. I'm I right on this?

You're wrong. Either a packet goes through the INPUT chain or it goes through the FORWARD chain, depending on its destination. Take a look at this packet flow diagram: http://www.linuxhomenetworking.com/wiki/images/f/f0/Iptables.gif

Corrado

-- Bastian Beischer RWTH Aachen University of Technology @CERN Office: Bdg 32-4-B12 Phone: +41-22-76-75750 E-mail: bastian.beischer@cern.ch Address: CERN, CH-1211 Geneve 23 @RWTH Aachen Office: 28 C 203 Phone: +49-241-80-27205 E-mail: beischer@physik.rwth-aachen.de Address: I. Physikalisches Institut B, Sommerfeldstr. 14, D-52074 Aachen

Thanks all for your help I finally decided to go with a more simple port forwarding solution using socat a tool to forward tcp conections. This way I can filter forwarded ports by using the router's INPUT chain. Cheers On Sun, Aug 26, 2012 at 1:08 PM, Peter Baldridge wrote:

On Sun, Aug 26, 2012 at 10:11 AM, Juan Diego Tascón wrote:

...

Is there any way to debug iptables, Juan,

Another good way to debug IPTables (if you can limit the traffic to the box to just what you are troubleshooting) use the command :

sudo iptables -Z && sudo watch -n .5 iptables -nvL

^zeros the counters for iptables

this will serve to show packet counters next to all your rules. Then you can send the traffic you are troubleshooting and see which rule it is matching. From a different window or screen you can add/drop rules and watch the counters in real time. That has always helped me in tough IPtables setups since it's a little more realtime/less info than logging.

-pete