# /etc/rsyslog.d/00-iptables.conf
:msg, contains, "iptables: " -/var/log/iptables.log
& ~
# My firewall rules
# BEGIN -- LOGGING
iptables -N logdrop
iptables -A logdrop -m limit --limit 20/m --limit-burst 40 -j LOG --log-prefix 'iptables: '
iptables -A logdrop -j DROP
iptables -A INPUT -j logdrop
# END -- LOGGING
# What I see in dmesg output:
[7431266.109194] iptables: IN=venet0 OUT= MAC= SRC=81.169.145.98 DST=81.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=0 DF PROTO=TCP SPT=25 DPT=54798 WINDOW=0 RES=0x00 RST URGP=0
[7431299.010661] iptables: IN=venet0 OUT= MAC= SRC=93.174.93.20 DST=81.x.x.x LEN=118 TOS=0x00 PREC=0x00 TTL=56 ID=7698 DF PROTO=UDP SPT=56264 DPT=1900 LEN=98