Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to block the packets whose source ip is not localhost(172.17.7.1) when sending out. how to do this ? I write a rule like this

iptables -A OUTPUT -s !172.17.7.1 -J DROP 

it does not work`

share|improve this question
    
Why are you saying that 172.17.7.1 is localhost? Localhost is the subnet 127./8, and only it. –  whitequark Nov 25 '10 at 9:34
    
172.17.7.1 is the gateway –  larry Nov 25 '10 at 9:40
add comment

1 Answer

up vote 1 down vote accepted

iptables -A OUTPUT -s ! 172.17.7.1 -j DROP

Use small caps "j" and append space after "!" sign, else it will be interpreted like a command from your shell history. Pay attention that you do apppend with A and not insert on the beginning of the chain.

share|improve this answer
    
thanks! can i add more conditions? for instance, block all the packets whose source ip is not localhost(172.17.7.1) and 58.30.30.3 –  larry Nov 25 '10 at 9:34
    
For every one additional IP address you must use another rule. But you can use IP/mask syntax to get few addresses if they are at the same range. Dropping all the output traffic you are at risk, for example to drop your server DNS query or any other traffic that is needed for normal use. Do not use term like localhost for IP addresses assigned to your network card. –  ntk Nov 25 '10 at 10:44
    
ntk, you are very nice, could you check this question out /? serverfault.com/questions/203324/… –  larry Nov 25 '10 at 14:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.