Linux Firewalls: Attack Detection and Response with iptables, psad, and fwsnort

Logging outgoing traffic blocked by the firewall rules is necessary for debugging the firewall rules and to be alerted to local software problems.

With the exception of outgoing ICMP type 3 errors, which were dropped previously, possibly all traffic about to be dropped by the default policy could be logged:

$IPT -A OUTPUT -o $INTERNET -j LOG