Output of lsmod:
ip_tables 23568 14 iptable_nat,ipt_state,ipt_length,ipt_ttl,ipt_tcpmss,ipt_TCPMSS,iptable_mangle,ipt_multiport,ipt_limit,ipt_LOG,ipt_TOS,ipt_tos,ipt_REJECT,iptable_filter
Relevant line in /etc/sysconfig/iptables-config:
IPTABLES_MODULES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"
Now I restart the VE, and check /var/log/messages.
I tried connecting to a forbidden port, no log.