3

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall.

Now I'm configuring network firewall which uses iptables, but I don't know whether I should be logging another chains like FORWARD, PREROUTING or POSTROUTING.

What security benefits would I get enabling those logs?

2

FORWARD:

It can be beneficial to log the FORWARD chain to doublecheck that routing decisions act as intended or to check that logic holes in the rules that you know to exist are covered. Often, logging the FORWARD chain is very targeted.

PREROUTING:

There is not a lot of value here to log because you will get flooded with noise. Unless you have processes in place to sort out the signal-to-noise ratio, there is little benefit.

POSTROUTING:

Because this happens after all the rules have fired, you should already know what is going to be in this log. If you want to know what bad things might have passed through, you would be better off running IDS systems after the firewall to give you this intelligence. The signal-to-noise ratio is also "off" at this point, but in the opposite direction: if you know how to properly identify the noise in the signal, then you would also be able to craft the rules properly. So, not a lot of actual benefit.

There may be other benefits to logging at these points, but from a "firewall security perspective" I'd stick to the higher value chains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.