My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me?The iptables setup:iptables -t nat -A PREROUTING -i ppp33 -p tcp --dport 44447 -j DNAT --to 192.168.1.101iptables -I FORWARD 1 -i ppp33 -p tcp -d 192.168.1.101 --dport 44447 -j ACCEPTiptables -A INPUT -i ppp33 -p tcp --syn -m limit --limit 6/h -j LOG --log-level 1 --log-prefix=Intrusion -> iptables -A FORWARD -i ppp33 -p tcp --syn -m limit --limit 6/h -j LOG --log-level 1 --log-prefix=Intrusion -> iptables -A INPUT -i ppp33 -j DROPiptables -A FORWARD -i ppp33 -j DROPSample log lines:klogd: Intrusion -> IN=ppp33 OUT= MAC= SRC=188.11.48.248 DST=2.40.146.60 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=12802 DF PROTO=TCP SPT=60584 DPT=64137 WINDOW=8192 RES=0x00 SYN URGP=0klogd: Intrusion -> IN=ppp33 OUT= MAC= SRC=188.11.48.248 DST=2.40.146.60 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=12889 DF PROTO=TCP SPT=60584 DPT=64137 WINDOW=8192 RES=0x00 SYN URGP=0
Meaning of log entries from an iptables configuration
linux;networking;logs;iptables;tcp
iptables -t nat -A PREROUTING -i ppp33 -p tcp --dport 44447 -j DNAT --to 192.168.1.101This means that your interface ppp33 has Network Address Translation (NAT) setup for all requests to the destination of 192.168.1.101:44447.iptables -I FORWARD 1 -i ppp33 -p tcp -d 192.168.1.101 --dport 44447 -j ACCEPTThis rule complements the previous rule by ensuring that the request is forwarded to the 192.168.1.101 host.iptables -A INPUT -i ppp33 -p tcp --syn -m limit --limit 6/h -j LOG --log-level 1 --log-prefix=Intrusion -> This rule states that when it sees SYN flags only in a TCP packet, it will log Intrusion upto 6 times per hour (thanks Gilles for the call out). This is commonly done to help an administrator discover Stealth network scans. This is for all tcp inbound to the host.iptables -A FORWARD -i ppp33 -p tcp --syn -m limit --limit 6/h -j LOG --log-level 1 --log-prefix=Intrusion -> This is the same as the above, but for all TCP packets intended to other hosts that sit behind this hosts NAT that it may be doing some translation for.iptables -A INPUT -i ppp33 -j DROPThis is a rule that is all encompassing. Should you see any other traffic that is intended for this host AND doesn't meet the above rules, DROP the connection.iptables -A FORWARD -i ppp33 -j DROPSame as the previous rule, but DROP connections for anything that may be forwarded onto another machine that this machine can forward to.I hope this helps.