iptables multiple -d flags not allowed
For problems of this kind you can define new chains and jumping between them. You might for example add a chain LOGGING
and at the beginning of this chain match those packets you don't want to log with an action of RETURN
:
$ iptables -N LOGGING
$ iptables -A LOGGING -d 127.0.0.0/8 -j RETURN
$ iptables -A LOGGING -d 239.192.0.0/16 -j RETURN
$ iptables -A LOGGING -j LOG
$ iptables -A OUTPUT -j LOGGING
This way, all packets coming through the OUTPUT
chain would first go through the LOGGING
chain and everything not being for 127.0.0.0/8
and 239.192.0.0/16
would be logged, then control would go back to the OUTPUT
.
Yes, but it doesn't work the way you want. From the man page:
Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).
The way to do this is to add rules earlier in the chain to divert the traffic you don't want to log or modify, e.g.
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT --destination 239.192.0.0 -j ACCEPT
-A OUTPUT -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7