---
name: "Lire::Firewall::IptablesDlfConverter"
section: "3pm"
platform: "linux"
package: "lire"
version: "2.1.1-8"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Lire::Firewall::IptablesDlfConverter"
---

# Lire::Firewall::IptablesDlfConverter(3pm)

convert netfilter/iptables syslog logs to firewall DLF

## NAME

IptablesDlfConverter - convert netfilter/iptables syslog logs to firewall DLF

## DESCRIPTION

**IptablesDlfConverter** converts Linux 2.4 iptables packet log into firewall DLF format.

## LIMITATIONS

The netfilter logging modules don't log the status of the packet (drop, accept, reject) like the ipchains logging code. You can specify a prefix that will be used in the log. This converter will mark the packet as 'denied' whenever that prefix matches (case insensitive) the following regex: 'denied\|deny\|drop\|reject\|unallowed', it will mark the packet as 'permitted' whenever that prefix matches (case insensitive) the following regex: 'accept\|permit', and all other packets will have '-' as the value of the 'action' field.

So in order for this converter to detect 'denied' packets, you should use a prefix containing one of those substrings.

For example:

```
 iptables -N lodrop
 iptables -A logdrop -j LOG --log-prefix "Packet-DENY: "
 iptables -A logdrop -j DROP
```

or other similar prefixes: 'denied: ', 'Packet-REJECT: ', ...

The prefix used will end up in the 'rule' field of the DLF record.

## EXAMPLES

IptablesDlfConvertor will be rarely used on its own, but is more likely called by lr\_log2report:

```
 $ lr_log2report iptables < /var/log/iptables.log > report
```

## SEE ALSO

The Netfilter webpage at http://netfilter.samba.org/ .

## AUTHORS

Francis J. Lacoste \<flacoste@logreport.org\>

## VERSION

`$Id:` IptablesDlfConverter.pm,v 1.12 2006/07/23 13:16:35 vanbaal Exp $

## COPYRIGHT

Copyright (C) 2001, 2002, 2003, 2004 Stichting LogReport Foundation LogReport@LogReport.org

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.