5

I need to block my server from initiating any connections to a remote server.

However, I still want the server to be able to reply from connections initiated via clients connected.

In other words, I want others to be able to connect to the server but for the server to not be able to initiate remote connections to other servers.

How can I do that?

I'm using Ubuntu.

| improve this question | | | | |
  • Block outbound TCP packets with SYN set unless they're related to an existing connection. – David Schwartz Jun 3 '15 at 23:30
9

Blocking all outgoing connections is a bad idea since that would prevent you from installing software from online repos, doing DNS searches (which would be terrible in most of the environments), keeping the clock updated with NTP, etc. Anyways, if you still want to do it, try this:

  # Drop all connections initiated from this host
iptables -t filter -I OUTPUT 1 -m state --state NEW -j DROP
  # Additionally, log the event (optional)
iptables -t filter -I OUTPUT 1 -m state --state NEW -j LOG --log-level warning \
  --log-prefix "Attempted to initiate a connection from a local process" \
  --log-uid

You can make the rules smarter by allowing certain traffic, like DNS. You can achieve that by two means:

  1. Make the matches more complex. Would be fine for one or two "whitelisting" items. Example:

      # Only forbid non-UDP traffic
    iptables -t filter -I OUTPUT 1 -m state --state NEW \! -p udp -j DROP
    
  2. Prepending rules which match some of the desired services which are allowed to be initiated from the local host with a "-j ACCEPT" target. Example:

      # Run this after the "DROP" rule to allow connection to ports
      #+ 80 and 443, mostly used for HTTP and HTTPS traffic
    iptables -t filter -I OUTPUT 1 -p udp -m multiport --ports 80,443 -j ACCEPT
    
| improve this answer | | | | |
  • Okay. So if disabling it is bad, how can I limit it to one connection per minute? – Joehot200 Jun 4 '15 at 6:52
  • Since I do not have time, I am going to block all outbound connections for now. It is unfortunately absolutely essential that I either block or severely limit outgoing traffic. – Joehot200 Jun 4 '15 at 6:55
  • 3
    You are asking two completly different questions. You should post a new question specifying exactly your problem, not asking an implementation for the solution you thought, since you don't have enough clarity on the matter. For example: "I have a limited upload rate for my VPS, how can I optimize my server with iptables or other solution to prioritize certain traffic and drop unnecessary traffic, given certaing needs?". You should have clear the concepts of "connection", "packet" and "traffic" (at least) before asking such specific questions to solve a problem which might be broader. – Diego Augusto Molina Jun 4 '15 at 19:21
  • 3
    In response to "how can I limit it to one connection per minute?", this can do something similar: iptables -t filter -I OUTPUT 1 -m state --state NEW -j DROP; iptables -t filter -I OUTPUT 1 -m state --state NEW -m limit --limit 1/minute -j ACCEPT. Note that this might not work for certain protocols such those wich need to initiate more than one connection in order to complete a functionality (e.g. FTP in PASV mode). – Diego Augusto Molina Jun 4 '15 at 19:27
3

Ubuntu's built in firewall is ufw. You can control it using a gui called Gufw. In Gufw's main pane, just click Outgoing:Deny.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.