RB750: Log dropped packets?

RouterOS General
1

Hi from Germany :slight_smile:

i have in my firewall rule 3 entrys to drop packets from some IPs.
I would like see all dropped packets in my log. But in older version of RouterOS gives a switch log=yes.
I have RB750 and i dont know what must i do for logging dropped packets.

I hope everyone can help me - Thanks!

Best regards
Andy

2

Make log rule (action=log) with same conditions as drop rule and place it before the drop rule.

3

Hi,

thank for the very fast answer.
For every rule i must a extra log-rule-entry before i drop the packet? Have i correct understand?

Best regards
Andy

4

Yes, that is correct.

5

Okay - Thank you!
But i dont unterstand why have you remove the switch “log=yes”. After youre workarounf i have double more entrys in my firewall rule. :open_mouth:
And i have not only three, it was a example, i have any more :confused:

Best regards
Andy

6

Adding action=log increases the options. You can use custom chain if you need to log and drop different kinds of traffic. For example, add chain “log and drop” that logs and drops all traffic that is processed through it.

/ip firewall filter
add  chain="log and drop" action=log 
add chain="log and drop" action=drop

Then use single rule with

action=jump jump-target="log and drop"

for traffic that need to be logged and dropped.

7

Hello,

ahhhh, i think i have understand.
And in combination with ip firewall address-lists i can all blocked ip-subnets, if i use in “drop and log”-rules under advanced → src. address list and need only one (both) entry, is this correct??

Best regards
Andy

8

How can I log just dropped packets from terminal?
/log print ← displays all logs

I want to display just dropped TCP log