Notification if someone tries to access a web server remotely?

[bmn1]

If I have a web server of some kind on for instance port 5000, is it possible to somehow get a notification every time someone tries to access it remotely (with their IP)? Or at least log it somewhere?

 

[thelonelycoder]

If I have a web server of some kind on for instance port 5000, is it possible to somehow get a notification every time someone tries to access it remotely (with their IP)? Or at least log it somewhere?

Most webservers have the ability to log the access, you just have to enable it and set the location.

 

[bmn1]

I was hoping to get it straight at the router. I have so many different kinds of servers (also without good logging functions). So if it's not easily possible, what's the hard way? I see it's possible to log to an external log server, but is that just for the system logs and not showing external IPs? If it's possible to use that, perhaps a logging server have an option to send email or push notifications when an IP tries to use a web server.

 

[thelonelycoder]

The logic would be to log a port forward event to syslog (by increasing log level perhaps), then have a cron job run a script that greps the event line, uses the time and IP as variable in an email sent to you.
Sounds doable to me.
Share when you're done.

 

[bmn1]

All that should be possible directly on the router, am I right?

 

[thelonelycoder]

All that should be possible directly on the router, am I right?

I guess so, at least this is how I would try to get it to work If I'd need it.
But I don't.
Good luck with scripting and let us know if and how it works when you celebrate your success.

 

[MichaelCG]

If you have "many different servers" and you are needing logging since they don't log, you should probably be looking at a more feature rich firewall than a run of the mill consumer device. I think you will be in for a rude awakening if you get per access alerting setup. Things that are exposed directly to the Internet will eventually get discovered and scanned on a regular basis. This is why application layer logging and alerting is usually much better since you can alert upon success/failure at the app itself instead of just some script kiddie sweeping your IP every 60 seconds.

 

[Steffe]

something like https://github.com/RMerl/asuswrt-merlin/wiki/WOL-Script-Wake-Up-Your-Webserver-On-Internet-Traffic