Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop letting silent firewall drops drive you insane

🧩 The Challenge

Trying to debug a connection that just hangs forever is the absolute worst because you never know if the server is ignoring you or if a firewall rule is silently black-holing the traffic. I’ve spent way too many nights guessing if my packets are hitting the wall or just disappearing into the void.

💡 The Fix

Use the log target in iptables to dump specific packets to the kernel ring buffer so you can actually see them being hit by your rules. It takes the mystery out of why a connection is failing.

iptables -A INPUT -p tcp --dport 8080 -j LOG --log-prefix "FIREWALL_DROP: " --log-level 7
dmesg | grep FIREWALL_DROP

⚙️ Why It Works

Adding that log rule before your drop or reject rule catches the packets mid-flight and writes the metadata directly to dmesg. Since it happens before the packet is discarded, you get an instant paper trail of exactly what is being denied.

🚀 Pro-Tip: Run dmesg -w if you want to watch the drops happen in real-time while you hammer the service from another terminal.

Linux Tips & Tricks | © ngelinux.com | 8/24/2026