IPTables: How to log and set a specific log file

Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?

Solution 1:

You can do this my configuring iptables to 'mark' the messages e.g.

iptables -A INPUT -s 192.0.2.0/24 -j LOG --log-prefix='[iptables] '

Which will cause a log message that is prefixed with the text [iptables]

Now you can configure your rsyslog to send these messages to a particular log file by adding a suitable entry to it's configuration e.g.

:msg,contains,"[iptables] " /var/log/iptables.log