How to Enable IPtables TRACE Target on Debian Squeeze (6)
I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables.
From the iptables man for TRACE:
This target marks packes so that the kernel will log every rule which match the packets as those traverse the tables, chains, rules. (The ipt_LOG or ip6t_LOG module is required for the logging.) The packets are logged with the string prefix: "TRACE: tablename:chain- name:type:rulenum " where type can be "rule" for plain rule, "return" for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. It can only be used in the raw table.
I use the following rule: iptables -A PREROUTING -t raw -p tcp -j TRACE
but nothing is appended either in /var/log/syslog or /var/log/kern.log!
Is there another step missing? Am I looking in the wrong place?
edit
Even though I can't find log entries, the TRACE target seems to be set up correctly since the packet counters get incremented:
# iptables -L -v -t raw
Chain PREROUTING (policy ACCEPT 193 packets, 63701 bytes)
pkts bytes target prot opt in out source destination
193 63701 TRACE tcp -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 178 packets, 65277 bytes)
pkts bytes target prot opt in out source destination
edit 2
The rule iptables -A PREROUTING -t raw -p tcp -j LOG
does print packet information to /var/log/syslog... Why doesn't TRACE work?
Run:
modprobe ipt_LOG
That fixed it for me.
Seems like (i.e. works for me) with new kernel this is needed (for IPv4):
modprobe nf_log_ipv4
sysctl net.netfilter.nf_log.2=nf_log_ipv4
credits:
- https://www.centos.org/forums/viewtopic.php?f=47&t=54411
- upvoting other answers as they gave me important hints