All you need to do is add a source subnet to any logging rule you've seen. Something like:

$IPTABLES -I FORWARD -m conntrack --ctstate NEW -s your_lan_subnet -j LOG

I would only log new packets as logging everything is pretty pointless to me unless you want to try and quantify the amount of traffic. There seems to be little point in logging the return packets as well.

You can optionally add a log message which you can then trap with an rsyslog filter. Check the "man iptables" pages.

If I ever do logging, I split the log messages out from the messages log with an rsyslogd filter, /etc/rsyslog.d/firewall.conf:

# Split out Firewall messages

if $programname == 'kernel' and $msg contains 'IN=' and $msg contains 'OUT=' then -/var/log/firewall

& stop

This is a bit of a kludge. If you log with a message you could filter on that instead.

Then I add a logrotate function to make the logs rotate, /etc/logrotate.d/firewall:

# rotate the firewall log

/var/log/firewall {

	notifempty

	missingok

	copytruncate

	create 0664 root root

	rotate 4

}

Awesome. Thanks! I've set up the rule and will keep an eye on it to see how it's running.