Linux Iptables

Overview

Linux iptables is the standard firewall functionality built into Linux systems. It provides packet filter rules for the Linux kernel firewall. The filters are organized in different tables containing chains of rules for network traffic packet handling.

App Function

The Linux IPTables app provides security-focused analysis of firewall logs:

• Parse iptables/netfilter log messages in key=value format
• Extract network metadata tags for filtering and analysis
• Map blocked traffic to MITRE ATT&CK techniques for threat classification
• Exclude internal-to-internal traffic from MITRE tagging to reduce alert fatigue
• Assign Criticality levels based on source context (High for external, Medium for internal)
• Categorize all firewall events as security class
• Provide Security Dashboard for SOC analysts
• Alert on MITRE-mapped threats and high-value port access attempts

Vendor Documentation

• Netfilter Project - Official iptables/nftables project
• iptables Manual - Command reference
• MITRE ATT&CK - Threat technique framework
• MITRE T1021 Remote Services
• MITRE T1190 Exploit Public-Facing Application

Device Configuration

Configure Linux iptables to send firewall logs to syslog:

1. Enable logging for dropped packets in iptables rules:

   bash
   Wrap: OnCopyFullscreen
   iptables -A INPUT -j LOG --log-prefix "[IPTables-Dropped] " --log-level 4
   iptables -A FORWARD -j LOG --log-prefix "[IPTables-Dropped] " --log-level 4
   

2. Forward kernel logs to LogZilla using one of the following methods. Replace LOGZILLA_IP with the LogZilla server IP address or DNS name.

   Option A: syslog-ng

   Add the following to /etc/syslog-ng/syslog-ng.conf:

   text
   Wrap: OnCopyFullscreen
   destination d_logzilla { udp("LOGZILLA_IP" port(514)); };
   filter f_kern { facility(kern); };
   log { source(s_sys); filter(f_kern); destination(d_logzilla); };
   

   Restart syslog-ng: systemctl restart syslog-ng

   Option B: rsyslog

   Create a configuration file to forward kernel facility logs:

   bash
   Wrap: OnCopyFullscreen
   cat > /etc/rsyslog.d/50-logzilla.conf << 'EOF'
   # Forward iptables/kernel logs to LogZilla
   kern.* @LOGZILLA_IP:514
   EOF
   systemctl restart rsyslog
   

Verification

Generate test traffic by attempting to connect to a blocked port, then verify events appear in LogZilla with program: iptables.

Incoming Log Format

Iptables logs use space-separated key=value format:

text
Wrap: OnCopyFullscreen
IN=eth0 OUT= MAC=aa:bb:cc:dd:ee:ff SRC=192.168.1.100 DST=10.0.0.1
LEN=40 PROTO=TCP SPT=12345 DPT=443

Parsed Metadata Fields

Log Examples

Packet Blocked by Firewall

text
Wrap: OnCopyFullscreen
[IPTables-Dropped] IN=eth0 OUT= MAC=4a:2a:b8:8e:09:87:fe:00:00:00:01:01:08:00
SRC=11.22.33.44 DST=55.66.77.88 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=57949
PROTO=TCP SPT=50369 DPT=110 WINDOW=1024 RES=0x00 SYN URGP=0

UDP Scan Attempt

text
Wrap: OnCopyFullscreen
IN=ens18 OUT= MAC=4a:51:b8:89:03:43:f4:92:bf:72:e4:fe:08:00
SRC=98.180.5.104 DST=192.168.10.110 LEN=182 TOS=0x00 PREC=0x00 TTL=110
ID=23459 DF PROTO=UDP SPT=47818 DPT=34092 LEN=162

Triggers

Triggers are aligned with MITRE ATT&CK techniques for threat classification.

MITRE ATT&CK Catch-All

Specific MITRE Techniques

Port-Based Triggers