Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to block the packets whose source ip is not localhost( when sending out. how to do this ? I write a rule like this

iptables -A OUTPUT -s ! -J DROP 

it does not work`

share|improve this question
Why are you saying that is localhost? Localhost is the subnet 127./8, and only it. – whitequark Nov 25 '10 at 9:34 is the gateway – larry Nov 25 '10 at 9:40
up vote 1 down vote accepted

iptables -A OUTPUT -s ! -j DROP

Use small caps "j" and append space after "!" sign, else it will be interpreted like a command from your shell history. Pay attention that you do apppend with A and not insert on the beginning of the chain.

share|improve this answer
thanks! can i add more conditions? for instance, block all the packets whose source ip is not localhost( and – larry Nov 25 '10 at 9:34
For every one additional IP address you must use another rule. But you can use IP/mask syntax to get few addresses if they are at the same range. Dropping all the output traffic you are at risk, for example to drop your server DNS query or any other traffic that is needed for normal use. Do not use term like localhost for IP addresses assigned to your network card. – ntk Nov 25 '10 at 10:44
ntk, you are very nice, could you check this question out /?… – larry Nov 25 '10 at 14:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.