LIRE::FIREWALL::IPTABLESDLFCONVERTER(3pm)

💅 IptablesDlfConverter(3pm) 💅

okay so this page is from LogReport's Lire Documentation, and the star of the show is IptablesDlfConverter(3pm) — manual name secured, vibe check passed. ✨

✨ NAME ✨

• IptablesDlfConverter — convert netfilter/iptables syslog logs to firewall DLF. that's it, that's the name. 💖

💅 DESCRIPTION 💅

IptablesDlfConverter converts Linux 2.4 iptables packet log into firewall DLF format. literally its whole job. 🦋

😭 LIMITATIONS 😭

okay bestie, this is the part where the netfilter logging modules are kinda doing their own thing: they don't log the status of the packet (drop, accept, reject) like the ipchains logging code does. 😭

you can specify a prefix that will be used in the log. this converter will mark the packet as 'denied' whenever that prefix matches — case insensitive — the following regex:

denied|deny|drop|reject|unallowed

it will mark the packet as 'permitted' whenever that prefix matches — case insensitive — the following regex:

accept|permit

and all other packets will have '-' as the value of the 'action' field. periodt. 💅

so for this converter to detect 'denied' packets, use a prefix containing one of those substrings. that's the whole trick, bestie. 👑

for example:

iptables -N lodrop
iptables -A logdrop -j LOG --log-prefix "Packet-DENY: "
iptables -A logdrop -j DROP

or other similar prefixes: 'denied: ', 'Packet-REJECT: ', ...

the prefix used will end up in the 'rule' field of the DLF record. iconic, but also: keep it in mind. 🎀

🌈 EXAMPLES 🌈

IptablesDlfConvertor will be rarely used on its own, but it's more likely to be called by lr_log2report:

$ lr_log2report iptables < /var/log/iptables.log > report

👀 SEE ALSO 👀

the Netfilter webpage at http://netfilter.samba.org/. go look, bestie. 👀

🫶 AUTHORS 🫶

Francis J. Lacoste <flacoste@logreport.org> — author credits, secured. 🫶

🎀 VERSION 🎀

here's the version line, exactly as it appears:

$Id: IptablesDlfConverter.pm,v 1.12 2006/07/23 13:16:35 vanbaal Exp $

💖 COPYRIGHT 💖

Copyright (C) 2001, 2002, 2003, 2004 Stichting LogReport Foundation — LogReport@LogReport.org. that's the copyright, no cap. 💖

legally speaking: this program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. 💅

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License for more details. ⚖️

you should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html. 🎀

---

💖 and that's the whole page, bestie! this was from Lire 2.1.1, dated 2025-09-28 — IptablesDlfConverter(3pm) out. 🎀✨