Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop iptables from hiding your dropped packets

🧩 The Challenge

Dealing with a service that refuses to connect, but the firewall logs are totally silent because you didn’t explicitly log the drops. It’s like searching for a ghost in the machine while staring at a blank screen.

💡 The Fix

Add a logging rule right before your drop policies so you can finally see exactly which traffic is hitting the floor and why. You will save yourself a massive amount of headache next time a port isn’t responding.

iptables -I INPUT -p tcp --dport 80 -j LOG --log-prefix "IPTABLES_DROP: " --log-level 4
iptables -I INPUT -p tcp --dport 80 -j DROP

⚙️ Why It Works

By inserting a logging target before the actual drop rule, the kernel sends a description of the packet to syslog or journald. That little bit of metadata is the difference between guessing for two hours and finding the culprit in two seconds.

🚀 Pro-Tip: Use –log-tcp-options and –log-ip-options if you need to debug weird handshake issues.

Linux Tips & Tricks | © ngelinux.com | 8/10/2026