Finding the packet dropper with the LOG target

A port is unreachable although ufw status says it is allowed. Stop guessing.

iptables -I INPUT 3 -p tcp --dport 8080 -j LOG --log-prefix 'FWTEST: ' --log-level 4

Then dmesg -w | grep FWTEST. Packets arrive and are dropped later — a rule is at fault. Nothing at all — the traffic never reached the host: security group, routing, or something upstream.

LOG is non-terminating; the packet keeps traversing the chain. Level 4 keeps it out of the info flood.

Rate-limit logging on production with -m limit --limit 10/min, or a scan will fill the disk with your own log lines.