mjhjmtu

My os :centos 7.

yum remove firewalld
yum install -y iptables
yum install -y iptables-services

I want to log all the ping from 111.1111.111.111 into iptables.log.

cat /etc/rsyslog.conf
kern.* /var/log/iptables.log
systemctl restart rsyslog

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j LOG
iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j DROP
service iptables save
service iptables restart

Now to ping from 111.111.111.111 to my vps.

1.iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j DROPcan work.

ping 104.223.65.117 
PING 104.223.65.117 (104.223.65.117) 56(84) bytes of data. ^C --- 104.223.65.117 
ping statistics --- 23 packets transmitted, 0 received, 100% packet loss, time 22003ms

2.iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j LOG can't work

cat /var/log/iptables.log

Nothing in it,how to log the ping action from 111.111.111.111 into /var/log/iptables.log ?

I got some material here:dmesg and iptables

dmesg reads from the kernel log buffer. Since iptables uses kernel logging
facility, that is where iptables log records appear in the first place.
There is no way you can make iptables log entries not appear in dmesg.

Does that means iptables log info can't be writtten into specified file?

Iptables log info can only be written into specified file this way:

dmesg > /var/log/iptables.log

or

dmesg >> /var/log/iptables.log

?

Is there another smart way to log automactically all info into /var/log/iptables.log?

Let's look at what your setup does:

iptables -N LOGGING

You create a new chain called LOGGING (which never gets any rules later on).

iptables -A INPUT -j LOGGING

All packets traversing the input chain jump to LOGGING. All rules after this rules will be ignored, as you never return from the LOGGING chain.

iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j LOG

This rule is inserted after the above jump, and never executed.

iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j DROP

After logging it, you want to drop the packet, meaning a reply won't be generated. Not sure if this is your intention.

So, don't do this. Clear all those rules with iptables -F INPUT, and then do instead just

iptables -A INPUT -p icmp --icmp-type 8 --source 111.111.111.111 -j LOG

Nothing else. Now do a ping and see if it shows up in the syslog (it does on my system).

If you really need to, you can add a rule to drop the ping afterwards.

The type of vps matter.

My vps'type is openvz.

The log file will display by dmesg and not written automatically into custome log file,it is a bug in openvz.

To change my vps into a kvm vps, problem solved.