How to log dropped originating (X-Forwarded-For) client IP

[LisichkinVlad]

Hello,
I am trying to get list of dropped originating (X-Forwarded-For) IP address.
Adding iptables -t mangle -I GEOIP-SHELL_IN -j LOG --log-tcp-options --log-ip-options log my NAT ip, not real (xff) client ip.
Which iptables will solve this?
Thanks in advance.
(Debian 12)

[friendly-bits]

Hi, I don't think you need X-FORWARDED-FOR. AFAIK NAT does not change the source address. geoip-shell creates rules which simply check whether source address (for inbound traffic) is included in the loaded ipsets, regardless of NAT. The example rule you posted, if placed first in the chain, will log any and all inbound IP traffic, including traffic sent by the NAT, so I believe that this is what you are seeing.

If your goal is to log blocked traffic then, provided that you are using geoip-shell in whitelist mode, you should be able to achieve this by adding a similar rule to the GEOIP-SHELL-IN chain, but this rule must be one-before-last (i.e. just before the DROP rule). If using geoip-shell in blacklist mode then I don't think you can achieve this without modifying the rules created by geoip-shell. Specifically, you would need to have another chain used for logging and jump to that chain for matching packets (rather than jumping directly to DROP).

Note that logging can have performance implications, and may allow for denial-of-service attacks, so you would likely want to rate-limit the logged traffic.

Implementing logging in geoip-shell has been requested before and I am planning to implement this, eventually.