Odtnhj

I'm trying to catch the logs generated by iptables running inside a container.
Since LOG support is disabled for container (see here), I'm trying to set the iptables log rules in the host.
I'm testing it with a rule (on the host) that catches a SYN scan from NMap (*1).

So the idea is to set iptables rules on host to log scans performed against a container (named c_victim), which is using a virtual bridged interface br-a1b2c3 (*2).

I've tried different rules similar to:

# iptables -I FORWARD -m physdev --physdev-out veth144i0 --physdev-is-bridged -j LOG --log-prefix "[fw::test]"

where veth144i0 is the virtual ethernet interface associated to br-a1b2c3 (*3). I got this rule from here.
None of the rules I tried generated logs in my host after checking with:

$ journalctl -b | grep "[fw.*]"

Any ideas on how to set the iptables rule in (*1) for a container??

(*1): Just to make sure that the rule works, I tested it in my host:

# iptables -I INPUT -p tcp -m multiport --dports 23,79 --tcp-flags ALL SYN -m limit --limit 3/m --limit-burst 5 -j LOG --log-prefix "[fw::syn-scan] "

then scanned the host from a container with:

root@887952fed115# nmap -sS 192.168.0.14

and then checked the logs with:

$ journalctl -b | grep "[fw.*]"

where the logs of the scan appear ok.

(*2): I know this because I checked using a combination of these commands:

$ docker container inspect c_victim | grep NetworkID 
$ docker network ls
$ ifconfig -a

(*3): I checked this by looking at the symlinks:

ls -l /sys/devices/virtual/net/veth*/master

As exploratory checks, I also set the rules (in host always):

# iptables -I FORWARD -i br-a1b2c3 -j LOG --log-prefix "[fw::test-in]"
# iptables -I FORWARD -o br-a1b2c3 -j LOG --log-prefix "[fw::test-out]"

to see what happens, and this is what I get:

• no logs are generated if I scan the container from the host.


• only the first one generates logs in my journalctl if I scan the host from the container c_victim.