Blocking ports with iptables

Question

I have a server with multiple interfaces (IPs). I'd like to block all ports on one of the IPs (I don't want to change anything for other IPs/interfaces), but allow outgoing connections from it. For example, it should be possible to run a IRC client from it, but it should not be possible to simply connect to it from the outside (I'll be connecting from a whitelisted IP).

This is what I got until now:

Chain INPUT (policy ACCEPT)
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            IP

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

But these rules don't work. Even when I initiate a connection from this IP, the remote server can't connect back, despite I'm allowing RELATED/ESTABLISHED connections. What's wrong?

Answer 1

First of all, default policy for OUTPUT Chain is ACCEPT, so the last line:

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

isn't necessary.

Then the first line:

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

is redundant too because default policy for INPUT is ACCEPT.

Try with only these two rules and see if it helps:

iptables -A INPUT -d IP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -d IP -j DROP

Answer 2

Are you specifically having an issue with IRC connections? The IRC server you're trying to connect to may be requiring you to run an ident server. Most IRC clients fake one. Try allowing incoming connections on port 113 and see if it improves.