Generate Temporary iptables Rules from Logs Using AI

I’ve been experimenting with LLMs to help interpret noisy security logs and turn them into actionable iptables rules. The idea isn’t to replace manual review but to speed up initial triage during an attack or scan. In my setup, I pipe recent syslog entries through a local Ollama instance running a 7B parameter model, asking it to suggest blocking IPs based on repeated failed SSH attempts or suspicious port scans. The output is a temporary iptables rule with a 20-minute timeout, which I can apply or discard after review.

Why Automate Rule Suggestions from Logs

Manual log analysis takes time, especially when you’re dealing with thousands of lines per minute during a brute-force attempt. I used to grep for ‘Failed password’ in /var/log/auth.log, sort by IP, and manually craft rules. It works, but it’s slow. By feeding summarized log data into an LLM, I get a proposed rule in seconds. The model doesn’t need to be perfect — it just needs to highlight patterns I might miss when tired or rushed. I treat its output as a starting point, not a final decision.

How I Set Up the Log Pipeline

I use a simple shell script that runs every five minutes via cron. It extracts the last 100 lines of auth.log, counts failed SSH attempts per IP, and formats a prompt for the LLM. Here’s the core logic:

#!/bin/bash
LOG_FILE="/var/log/auth.log"
RECENT=$(sudo tail -n 100 "$LOG_FILE")
PROMPT="Analyze these SSH log entries for brute-force patterns. List IPs with 5+ failed attempts in the last 10 minutes. For each, suggest a temporary iptables rule to block port 22 for 20 minutes. Output only the iptables commands, one per line."

RESPONSE=$(ollama run llama3:8b "$PROMPT\n\n$RECENT")

if [ -n "$RESPONSE" ]; then
  echo "$RESPONSE" | while read -r line; do
    if [[ $line =~ ^iptables ]]; then
      echo "[SUGGESTION] $line"
      # Uncomment to auto-apply: sudo $line && sudo timeout 20m iptables -D INPUT $(echo $line | cut -d' ' -f4- | sed 's/-A/-D/')
    fi
  done
fi

This script doesn’t auto-apply rules by default — I review them first. The commented-out line shows how you could enable automation with a timeout-based cleanup, but I prefer manual confirmation until the model’s accuracy improves in my environment.

Sample Output and Interpretation

Last week, during a sudden spike in SSH attempts from a hosting provider’s IP range, the script returned:

[SUGGESTION] iptables -A INPUT -p tcp -s 185.130.105.204 -j DROP --dport 22
[SUGGESTION] iptables -A INPUT -p tcp -s 185.130.105.205 -j DROP --dport 22

I reviewed the logs, confirmed the pattern matched a dictionary attack, and applied the rules. After 20 minutes, they expired automatically via the timeout command I keep in my notes. No false positives in that instance, but I’ve seen the model over-suggest on noisy services like fail2ban-triggered logs — hence the need for oversight.

Limitations and Safety Checks

LLMs can hallucinate or miscontextualize logs, especially if the prompt isn’t tight or the model is too small. I avoid sending raw, unfiltered logs to prevent token overload and privacy leaks. Instead, I pre-process with awk or grep to reduce noise. Also, I never expose this to external APIs — everything runs locally on a dedicated VM with Ollama and CPU-only inference.

A useful tip: always test the generated rule syntax with iptables -C (check) before applying, or simulate with nft -f if you’re on nftables. Another safeguard is to log all suggested rules to a separate file for audit, which I do via syslog.

When This Approach Helps Most

This method shines during off-hours or when you’re managing multiple servers and can’t watch logs in real time. It’s not a replacement for fail2ban or CrowdSec, but a complementary tool for ad-hoc analysis or hardening transient exposures. As I mentioned before in my post on AI-assisted log analysis (https://furkanikkan.com/urun/ai-destekli-log-analizi-syslog-tan-gecici-iptables-kurali-uretme-101), the goal is augmenting human judgment, not automating it blindly.

If you’re running a Linux firewall and want to experiment with AI-assisted ops, start small: test the script on a non-critical host, tune the prompt, and validate every suggestion. Over time, you’ll see where it adds value — and where it doesn’t.

Cover image: Jefferson Lab · PDM (Openverse / kamu malı) · https://www.flickr.com/photos/53950384@N02/55166403368