Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make some simple iptables rules to deny all incoming connections and allow outgoing. How can I do that?

share|improve this question
up vote 8 down vote accepted

Try this with root access :

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Accept on localhost
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established sessions to receive traffic
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
When I do first line of your rule, i've got disconnected from SSH – holms Oct 6 '14 at 7:26
3  
The question is "deny all incoming connections" and not "deny all incoming connections except SSH" :) – Yohann Dec 4 '14 at 16:17

If you’re working remotely via SSH, you might want to add this (-I inserts it before all other rules in INPUT):

iptables -I INPUT -p tcp --dport 22 -j ACCEPT

If your SSH service is listening on another port, you’ll have to use that port instead of 22.

Otherwise, you might accidentally lose access.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .