Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I nat all tcp to a socks proxy doing something like..

sudo iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner USER -m tcp -j REDIRECT --to-ports XXX

Therefore all packets go there, it works.

I know that local socks proxy connect to a IP and I want to allow my computer to access only that IP. The way I try to do it is..

sudo iptables -P OUTPUT DROP

then I add an exception

sudo iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT (loopback)
sudo iptables -A OUTPUT -d xxx.yyy.xxx.zzz -j ACCEPT

I have used wireshark to see if my computer connects to another IP but it only connects to that IP but somehow when I say to iptables DROP everything except that one with ALL protocols allowed and ALL ports, it is not working. I really cant understand it.

share|improve this question
add comment

2 Answers

I think you should add that drop-rule at the end because it's first processed if you added it first. And since all packets match that drop-rule, all further rules will be ignored.

share|improve this answer
    
-P sets the policy for the chain, it's not a rule in the chain. –  Nathan Powell Jul 9 '11 at 11:46
    
oh yes... must have been sleeping –  wullxz Jul 11 '11 at 7:30
add comment
  1. Use "-v, --verbose", you see iptables counter. This is a good tool for debugging.
  2. Use LOG target to debug iptables rules.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.