destination d_Asterisk { file("/var/log/remote-log/Asterisk.log"); };
<b>filter f_Asterisk { netmask("10.10.10.100/255.255.255.255"); };</b>
log { source(net); filter(f_Asterisk); destination(d_Asterisk); };
[root@localhost remote-log]# tcpdump -i enp0s25 port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s25, link-type EN10MB (Ethernet), capture size 262144 bytes
21:40:40.652672 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:40:42.342638 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:40:55.881964 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 701787264:701787340, ack 2555450757, win 229, options [nop,nop,TS val 12988235 ecr 13051817], length 76
21:40:55.881983 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 76, win 990, options [nop,nop,TS val 13083841 ecr 12988235], length 0
21:40:55.887790 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 76:152, ack 1, win 229, options [nop,nop,TS val 12988241 ecr 13083841], length 76
21:40:55.887803 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 152, win 990, options [nop,nop,TS val 13083847 ecr 12988241], length 0
21:40:55.893968 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 152:228, ack 1, win 229, options [nop,nop,TS val 12988248 ecr 13083847], length 76
21:40:55.893980 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 228, win 990, options [nop,nop,TS val 13083853 ecr 12988248], length 0
21:40:55.902742 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 228:304, ack 1, win 229, options [nop,nop,TS val 12988256 ecr 13083853], length 76
21:40:55.902754 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 304, win 990, options [nop,nop,TS val 13083862 ecr 12988256], length 0
21:40:55.912977 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 304:473, ack 1, win 229, options [nop,nop,TS val 12988266 ecr 13083862], length 169
21:40:55.912990 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 473, win 1005, options [nop,nop,TS val 13083872 ecr 12988266], length 0
21:40:55.916795 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 473:586, ack 1, win 229, options [nop,nop,TS val 12988270 ecr 13083872], length 113
21:40:55.916806 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 586, win 1005, options [nop,nop,TS val 13083876 ecr 12988270], length 0
21:40:55.919975 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 586:724, ack 1, win 229, options [nop,nop,TS val 12988274 ecr 13083876], length 138
21:40:55.919987 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 724, win 1020, options [nop,nop,TS val 13083879 ecr 12988274], length 0
21:40:56.340949 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 724:796, ack 1, win 229, options [nop,nop,TS val 12988695 ecr 13083879], length 72
21:40:56.340963 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 796, win 1020, options [nop,nop,TS val 13084300 ecr 12988695], length 0
21:40:57.326451 IP 10.10.10.110.50180 > localhost.localdomain.shell: Flags [P.], seq 796:872, ack 1, win 229, options [nop,nop,TS val 12989680 ecr 13084300], length 76
21:40:57.326465 IP localhost.localdomain.shell > 10.10.10.110.50180: Flags [.], ack 872, win 1020, options [nop,nop,TS val 13085285 ecr 12989680], length 0
21:41:17.042908 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:29.563154 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:29.992934 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:30.233048 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:30.583382 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:31.122988 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:31.313001 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:32.793141 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
21:41:32.973038 IP gateway.56177 > localhost.localdomain.syslog: [|syslog]
[root@localhost remote-log]# iptables -L -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
22 1264 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
0 0 ACCEPT tcp -- enp0s25 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25333
12 2048 ACCEPT udp -- enp0s25 * 0.0.0.0/0 0.0.0.0/0 udp dpt:514
1 60 ACCEPT tcp -- enp0s25 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:514
22 1248 undef_in all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 undef_fw all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
31 6984 ACCEPT all -- * enp0s25 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
0 0 undef_out all -- * * 0.0.0.0/0 0.0.0.0/0
Chain undef_fw (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix "-- FW -- DROP "
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain undef_in (1 references)
pkts bytes target prot opt in out source destination
22 1248 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix "-- IN -- DROP "
22 1248 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain undef_out (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix "-- OUT -- DROP "
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0