:msg, contains, "iptables:" -/var/log/iptables.log & ~