1

I have a server running CentOS 5.5 and acting as an OpenVZ host. One of the containers has been sending out spam and I need to block his ability to connect to outbound port 25. I've looked at http://wiki.openvz.org/Setting_up_an_iptables_firewall, but this setup is to prevent INCOMING traffic and I have not found a working IPTABLES rule that prevented a specific IP address from connecting to an OUTBOUND port.

I've tried:
iptables -I OUTPUT --source [CONTAINER_IP] --protocol tcp --destination-port 25 -j DROP
but that does not appear to actually block it. Any ideas would be appreciated.

2 Answers 2

3

The OUTPUT table is used for sending traffic originating from the host. With Virtualization I'm not sure if the traffic uses the OUTPUT chain, or as it's being routed from a virtual device through the host, it may use the FORWARD chain instead. Try replacing OUTPUT with FORWARD in your rule.

0
0

Kyle Smith's answer is correct with small notice: this rule must be placed defore any other FORWARD rules:

iptables -L

Chain FORWARD (policy ACCEPT)

target prot opt source destination

DROP tcp -- [CONTAINER_IP] anywhere tcp dpt:smtp

RH-Firewall-1-INPUT all -- anywhere anywhere

/etc/sysconfig/iptables

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

/* Block outgoing 25 port for containers */

-A FORWARD -p tcp --destination-port 25 -s [CONTAINER_IP] -j DROP

/* Main config */

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

1
  • More specifically it needs to be placed before any DROP rules that would block it.
    – Kyle Smith
    Jun 10, 2011 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .