.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Required to disable full justification in groff 1.23.0.
.if n .ds AD l
.\" ========================================================================
.\"
.IX Title "IptablesDlfConverter 3pm"
.TH IptablesDlfConverter 3pm 2025-09-28 "Lire 2.1.1" "LogReport's Lire Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
IptablesDlfConverter \- convert netfilter/iptables syslog logs to firewall DLF
.SH DESCRIPTION
.IX Header "DESCRIPTION"
\&\fBIptablesDlfConverter\fR converts Linux 2.4 iptables packet log into firewall DLF format.
.SH LIMITATIONS
.IX Header "LIMITATIONS"
The netfilter logging modules don\*(Aqt log the status of the packet
(drop, accept, reject) like the ipchains logging code. You can specify
a prefix that will be used in the log. This converter will mark the
packet as \*(Aqdenied\*(Aq whenever that prefix matches (case insensitive) the
following regex: \*(Aqdenied|deny|drop|reject|unallowed\*(Aq, it will mark the
packet as \*(Aqpermitted\*(Aq whenever that prefix matches (case insensitive)
the following regex: \*(Aqaccept|permit\*(Aq, and all other packets will have
\&\*(Aq\-\*(Aq as the value of the \*(Aqaction\*(Aq field.
.PP
So in order for this converter to detect \*(Aqdenied\*(Aq packets, you should use a
prefix containing one of those substrings.
.PP
For example:
.PP
.Vb 3
\& iptables \-N lodrop
\& iptables \-A logdrop \-j LOG \-\-log\-prefix "Packet\-DENY: "
\& iptables \-A logdrop \-j DROP
.Ve
.PP
or other similar prefixes: \*(Aqdenied: \*(Aq, \*(AqPacket\-REJECT: \*(Aq, ...
.PP
The prefix used will end up in the \*(Aqrule\*(Aq field of the DLF record.
.SH EXAMPLES
.IX Header "EXAMPLES"
IptablesDlfConvertor will be rarely used on its own, but is more likely
called by lr_log2report:
.PP
.Vb 1
\& $ lr_log2report iptables < /var/log/iptables.log > report
.Ve
.SH "SEE ALSO"
.IX Header "SEE ALSO"
The Netfilter webpage at http://netfilter.samba.org/ .
.SH AUTHORS
.IX Header "AUTHORS"
Francis J. Lacoste <flacoste@logreport.org>
.SH VERSION
.IX Header "VERSION"
\&\f(CW$Id:\fR IptablesDlfConverter.pm,v 1.12 2006/07/23 13:16:35 vanbaal Exp $
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (C) 2001, 2002, 2003, 2004 Stichting LogReport Foundation
LogReport@LogReport.org
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.PP
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
.PP
You should have received a copy of the GNU General Public License
along with this program (see COPYING); if not, check with
http://www.gnu.org/copyleft/gpl.html.