Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a server to operate as a tor relay and nothing else. I setup iptables to only allow talk on port 9001 and it worked fine, but there was an issue, the clock needs to be properly set and maintained for the relay to work properly, so I needed ntpd setup and running, but for some reason I can't get iptables to work as I want it. I'm trying to have it allow only tor and ntpd to talk over the network, but when I set it up to allow port 123 using udp, suddenly it ignores my -A OUTPUT ! -s -j DROP and allows everything through. How should I go about this? Please excuse my ignorance, I've brand new to iptables.

I've gone through a number of permutations, but here are my rules as they stand now:

-A INPUT -p udp --sport 123 --dport 123 -j ACCEPT
-A OUTPUT -p udp --sport 123 --dport 123 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 9001 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9001 -j ACCEPT
-A INPUT ! -s -j DROP
-A OUTPUT ! -s -j DROP
share|improve this question
You should post your rules. It is pretty much impossible to troubleshoot, not seeing the rest of your rule chain. – solefald May 13 '10 at 3:49
up vote 2 down vote accepted

two generic hints. as first rules always put:

iptables -P DROP 
iptables -F # clean things up. i assume you connect locally, otherwise your ssh will stop to work.
itables -A INPUT -i lo -j ACCEPT
itables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

and then your regulars

iptables -A INPUT -p udp --dport 123 -j ACCEPT # assuming you are ntp server
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT # try to narrow it down using -s to couple public ntp servers
iptables -A INPUT -m state --state NEW -p tcp --dport 9001 -j ACCEPT # assuming you take incomming tor connections here
iptables -A OUTPUT -m state --state NEW  -p tcp --dport 9001 -j ACCEPT # assuming you allow outgoing connections to other tor nodes
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.