6

I need to block my server from initiating any connections to a remote server.

However, I still want the server to be able to reply from connections initiated via clients connected.

In other words, I want others to be able to connect to the server but for the server to not be able to initiate remote connections to other servers.

How can I do that?

I'm using Ubuntu.

Improve this question
1
  • Block outbound TCP packets with SYN set unless they're related to an existing connection.
    – David Schwartz
    Jun 3, 2015 at 23:30

2 Answers 2

Reset to default
11

Blocking all outgoing connections is a bad idea since that would prevent you from installing software from online repos, doing DNS searches (which would be terrible in most of the environments), keeping the clock updated with NTP, etc. Anyways, if you still want to do it, try this:

  # Drop all connections initiated from this host
iptables -t filter -I OUTPUT 1 -m state --state NEW -j DROP
  # Additionally, log the event (optional)
iptables -t filter -I OUTPUT 1 -m state --state NEW -j LOG --log-level warning \
  --log-prefix "Attempted to initiate a connection from a local process" \
  --log-uid

You can make the rules smarter by allowing certain traffic, like DNS. You can achieve that by two means:

  1. Make the matches more complex. Would be fine for one or two "whitelisting" items. Example:

      # Only forbid non-UDP traffic
iptables -t filter -I OUTPUT 1 -m state --state NEW \! -p udp -j DROP

  2. Prepending rules which match some of the desired services which are allowed to be initiated from the local host with a "-j ACCEPT" target. Example:

      # Run this after the "DROP" rule to allow connection to ports
  #+ 80 and 443, mostly used for HTTP and HTTPS traffic
iptables -t filter -I OUTPUT 1 -p udp -m multiport --ports 80,443 -j ACCEPT
Improve this answer
5
  • Okay. So if disabling it is bad, how can I limit it to one connection per minute?
    – Joehot200
    Jun 4, 2015 at 6:52
  • Since I do not have time, I am going to block all outbound connections for now. It is unfortunately absolutely essential that I either block or severely limit outgoing traffic.
    – Joehot200
    Jun 4, 2015 at 6:55
  • 3
    You are asking two completly different questions. You should post a new question specifying exactly your problem, not asking an implementation for the solution you thought, since you don't have enough clarity on the matter. For example: "I have a limited upload rate for my VPS, how can I optimize my server with iptables or other solution to prioritize certain traffic and drop unnecessary traffic, given certaing needs?". You should have clear the concepts of "connection", "packet" and "traffic" (at least) before asking such specific questions to solve a problem which might be broader.
    – Diego Augusto Molina
    Jun 4, 2015 at 19:21
  • 3
    In response to "how can I limit it to one connection per minute?", this can do something similar: iptables -t filter -I OUTPUT 1 -m state --state NEW -j DROP; iptables -t filter -I OUTPUT 1 -m state --state NEW -m limit --limit 1/minute -j ACCEPT. Note that this might not work for certain protocols such those wich need to initiate more than one connection in order to complete a functionality (e.g. FTP in PASV mode).
    – Diego Augusto Molina
    Jun 4, 2015 at 19:27
  • Note that this allows disallows connections locally! In order to allow your services to still be able to communication with themselves and your local network, AFTER you run the above, you'll want to run: iptables -t filter -I OUTPUT 1 -s 127.0.0.0/24 -m state --state NEW -j ACCEPT -- You can also run this for 192.168.0.0/24 or 10.0.0.0/16 depending on what you have your local DHCP configured to.
    – Swivel
    Oct 16, 2023 at 6:32
3

Ubuntu's built in firewall is ufw. You can control it using a gui called Gufw. In Gufw's main pane, just click Outgoing:Deny.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .