I have a server with multiple interfaces (IPs). I'd like to block all ports on one of the IPs (I don't want to change anything for other IPs/interfaces), but allow outgoing connections from it. For example, it should be possible to run a IRC client from it, but it should not be possible to simply connect to it from the outside (I'll be connecting from a whitelisted IP).
This is what I got until now:
Chain INPUT (policy ACCEPT) ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 IP Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
But these rules don't work. Even when I initiate a connection from this IP, the remote server can't connect back, despite I'm allowing RELATED/ESTABLISHED connections. What's wrong?