4

I'm quite new to Linux and using iptables. Here is what I am trying to accomplish:

  1. I have an ASP.net client that talks with a web service hosted through web-logic on linux. The communication is over SSL.

  2. What I am trying accomplish using iptables is only block the response back to the client.

  3. So the client makes a web service call, the web service processes the request and replies back to the client.

  4. I want the web service to receive the request but block its response back to the client.

What I did for test purposes was flush all the rules from iptables. I created default policies for ACCEPT on the INPUT, OUTPUT and FORWARD chains. Next I added a rule to the OUTPUT chain to DROP anything which has the source IP of the client.

iptables -A OUTPUT -s client_ip_address -j DROP

Apparently, this made no difference. I can call the web service from the client and still receive a response.

Any help is appreciated?

Improve this question
7
  • Don't you want -s client_ip_address to be -d client_ip_address, since you want to block connecting out to the client?
    – Dan Fego
    Feb 1, 2012 at 16:19
  • I tried that as well but doesn't work. Also I'm not sure that it should be the destination (-d) because the TCP stream is not originating from the host which has the web service. The response would go back on the same TCP stream that originating from the client so I am thinking I would want to block the output to that source. Am I making sense here?
    – IceFossil
    Feb 1, 2012 at 16:30
  • I'm just digging here, but what if you try adding --state ESTABLISHED? (I'd say with -d, but you can also try -s).
    – Dan Fego
    Feb 1, 2012 at 16:34
  • 2
    If you block the response, the HTTP user agent will ultimately hang. What's the point of doing that?
    – jørgensen
    Feb 1, 2012 at 16:35
  • 1
    @j0rgensen ... thats exactly what I am trying to test. Timeout situations or hangs when it does not get a response.
    – IceFossil
    Feb 1, 2012 at 16:40

2 Answers 2

Reset to default
4

It depends on what exactly do you want to accomplish. If you want to simulate network timeout use this:

iptables -A OUTPUT -d clientip  -j DROP

it will silently drop all packets from the server to the client.

If you want to let tcp handshake happen and then to kill the connection (might be useful or you can just activate the above rule later) use this:

iptables -A OUTPUT -d clientip -p tcp --tcp-flags SYN,ACK SYN,ACK -j ACCEPT
iptables -A OUTPUT -d clientip  -j DROP

If you want to simulate closed port (service not running) use:

iptables -A INPUT -s clientip  -j REJECT

it will send ICMP Destination unreachable message back to the client.

Hope it helps.

Improve this answer
0

It's possible that you have a rule earlier in the OUTPUT chain that allows all ESTABLISHED and RELATED connections - this is quite common. If such a rule is there, it will be matched before a DROP rule you put in with -A. Try putting your DROP rule as early as possible in the OUTPUT chain:

iptables -I OUTPUT -d clientip  -j DROP

will put the rule at the very top of the chain.

Improve this answer

You must log in to answer this question.