Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with multiple interfaces (IPs). I'd like to block all ports on one of the IPs (I don't want to change anything for other IPs/interfaces), but allow outgoing connections from it. For example, it should be possible to run a IRC client from it, but it should not be possible to simply connect to it from the outside (I'll be connecting from a whitelisted IP).

This is what I got until now:

Chain INPUT (policy ACCEPT)
ACCEPT     all  --             state RELATED,ESTABLISHED
DROP       all  --            IP

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --             state RELATED,ESTABLISHED

But these rules don't work. Even when I initiate a connection from this IP, the remote server can't connect back, despite I'm allowing RELATED/ESTABLISHED connections. What's wrong?

share|improve this question
up vote 2 down vote accepted

First of all, default policy for OUTPUT Chain is ACCEPT, so the last line:

ACCEPT     all  --             state RELATED,ESTABLISHED

isn't necessary.

Then the first line:

ACCEPT     all  --             state RELATED,ESTABLISHED

is redundant too because default policy for INPUT is ACCEPT.

Try with only these two rules and see if it helps:

iptables -A INPUT -d IP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -d IP -j DROP
share|improve this answer

Are you specifically having an issue with IRC connections? The IRC server you're trying to connect to may be requiring you to run an ident server. Most IRC clients fake one. Try allowing incoming connections on port 113 and see if it improves.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .