# [Kernel 3.4] Netfilter's LOG target support [Solved]

## aCOSwt

Up to 3.3, I could find and had set :

- Netfilter LOG over NFNETLINK interface (CONFIG_NETFILTER_NETLINK_LOG)

- "NFLOG" target support (CONFIG_NETFILTER_XT_TARGET_NFLOG)

- LOG target support (CONFIG_IP_NF_TARGET_LOG)

Keeping the

- ULOG target support (CONFIG_IP_NF_TARGET_ULOG) unset

I now consider 3.4 in which I can still find :

- Netfilter LOG over NFNETLINK interface (CONFIG_NETFILTER_NETLINK_LOG)

- "NFLOG" target support (CONFIG_NETFILTER_XT_TARGET_NFLOG)

But now the

- LOG target support is (CONFIG_NETFILTER_XT_TARGET_LOG) So I believe this different from 3.3's LOG target support

Being under the level of a n00b in netfiltering, I do not know what I should do.

For information, I just need the following very basic iptables rules to work :

iptables -F

iptables -t nat -F

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i eth0 -j ACCEPT

iptables -A INPUT -i ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i eth0 -j ACCEPT

iptables -A FORWARD -i ppp0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A POSTROUTING -t nat -o ppp0 -j MASQUERADE 

iptables -A INPUT -j LOG

iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

----------

## toralf

IMHO you need at least something like CONFIG_NETFILTER_XT_TARGET_LOG=m for "iptables -A INPUT -j LOG "

----------

## aCOSwt

 *toralf wrote:*   

> IMHO you need at least something like CONFIG_NETFILTER_XT_TARGET_LOG=m for "iptables -A INPUT -j LOG "

 

For sure I certainly need some LOG target support, that's why, up to 3.3, I was selecting CONFIG_IP_NF_TARGET_LOG

But now, if I search for CONFIG_IP_NF_TARGET_LOG within menuconfig, I just get : No matches found.   :Confused: 

The only thing matching LOG target support is now associated to the CONFIG_NETFILTER_XT_TARGET_LOG label and is marked (NEW).

So I believe this is something totally different and possibly not related.   :Confused: 

----------

## toralf

 *aCOSwt wrote:*   

> 
> 
> So I believe this is something totally different and possibly not related.  

 No, it is just renamed AFACT - (BTW which was a pitfall for me too when I made a "make oldconfig")

----------

## Odward

With a cursory search, according to a post Here.

The ipt_LOG and ip6t_LOG have been merged into xt_LOG.

Plus apparently users with -j LOG rules in their iptables were getting errors until they set

CONFIG_NETFILTER_XT_TARGET_LOG

So that does appear to be the new module required for logging.

----------

## aCOSwt

Thanks a lot toralf and Odward for your help & detailed explanation.

----------

