Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I nat all tcp to a socks proxy doing something like..

sudo iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner USER -m tcp -j REDIRECT --to-ports XXX

Therefore all packets go there, it works.

I know that local socks proxy connect to a IP and I want to allow my computer to access only that IP. The way I try to do it is..

sudo iptables -P OUTPUT DROP

then I add an exception

sudo iptables -A OUTPUT -o lo -d -j ACCEPT (loopback)
sudo iptables -A OUTPUT -d -j ACCEPT

I have used wireshark to see if my computer connects to another IP but it only connects to that IP but somehow when I say to iptables DROP everything except that one with ALL protocols allowed and ALL ports, it is not working. I really cant understand it.

share|improve this question
  1. Use "-v, --verbose", you see iptables counter. This is a good tool for debugging.
  2. Use LOG target to debug iptables rules.
share|improve this answer

I think you should add that drop-rule at the end because it's first processed if you added it first. And since all packets match that drop-rule, all further rules will be ignored.

share|improve this answer
-P sets the policy for the chain, it's not a rule in the chain. – Nathan Powell Jul 9 '11 at 11:46
oh yes... must have been sleeping – wullxz Jul 11 '11 at 7:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.