Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make some simple iptables rules to deny all incoming connections and allow outgoing. How can I do that?

share|improve this question
up vote 8 down vote accepted

Try this with root access :

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Accept on localhost
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established sessions to receive traffic
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
When I do first line of your rule, i've got disconnected from SSH – holms Oct 6 '14 at 7:26
The question is "deny all incoming connections" and not "deny all incoming connections except SSH" :) – Yohann Dec 4 '14 at 16:17

If you’re working remotely via SSH, you might want to add this (-I inserts it before all other rules in INPUT):

iptables -I INPUT -p tcp --dport 22 -j ACCEPT

If your SSH service is listening on another port, you’ll have to use that port instead of 22.

Otherwise, you might accidentally lose access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.