Log every IP connecting on a system with iptables
I would try this:
# IP address entry older than one day
iptables -A ... -m recent --name mydaily ! --rcheck ! --seconds 86400 -j logandset
# IP address never seen before
iptables -A ... -m recent --name mydaily ! --rcheck -j logandset
# Custom chain for logging and refreshing
iptables -N logandset
iptables -A logandset -j LOG
iptables -A logandset -m recent --name mydaily --set
So your list mydaily
will keep track of the last seen IP addresses, and if it was never seen before, or if the last seen is older than one day, the packet will be logged, and the list entry for that IP address be updated.
You should probably set ip_list_tot
to a higher value for mydaily
, as explained in the iptables manpage (In your case for /proc/net/xt_recent/mydaily).