Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)
Stop iptables from hiding your dropped packets
🧩 The Challenge
Dealing with a service that refuses to connect, but the firewall logs are totally silent because you didn’t explicitly log the drops. It’s like searching for a ghost in the machine while staring at a blank screen.
đź’ˇ The Fix
Add a logging rule right before your drop policies so you can finally see exactly which traffic is hitting the floor and why. You will save yourself a massive amount of headache next time a port isn’t responding.
iptables -I INPUT -p tcp --dport 80 -j LOG --log-prefix "IPTABLES_DROP: " --log-level 4
iptables -I INPUT -p tcp --dport 80 -j DROP⚙️ Why It Works
By inserting a logging target before the actual drop rule, the kernel sends a description of the packet to syslog or journald. That little bit of metadata is the difference between guessing for two hours and finding the culprit in two seconds.
🚀 Pro-Tip: Use –log-tcp-options and –log-ip-options if you need to debug weird handshake issues.
Linux Tips & Tricks | © ngelinux.com | 8/10/2026