up vote 0 down vote favorite
share [g+] share [fb]

How do I setup an iptable setting to drop all IP packets that don't have my IP address on it? (do I even need to do this?)

This is the closest I can think of, but I think it doesn't quite work because I somehow need to be able to specify NOT destination AND source.

* filter

-A INPUT -i eth0 -d ! 1.2.3.4 -j DROP

COMMIT
link|improve this question
88% accept rate
feedback

2 Answers

up vote 2 down vote accepted

You don't need to do this; the networking stack ignores packets that aren't destined for your machine. Only hosts on your local network would be able to send you packets with the wrong destination address anyway. This would also block broadcasts, which may be a problem.

link|improve this answer
Well that's what I am thinking, but when I am running a screen session, sometimes my bandwidth meter goes way up. When I run iftop default (nonpromiscous mode) it shows other people's packets. Maybe this has to do with being on a Xen share? – Unknown Jun 6 '09 at 6:51
This is entirely possible. Xen tends to do some funny things to networking. – David Pashley Jun 6 '09 at 6:58
@David, I think i may be on a hub instead of a switch. Do I need any iptable filters if this is the case? – Unknown Jun 6 '09 at 8:40
Nope, your networking stack still won't accept the packets and will just ignore them. – David Pashley Jun 6 '09 at 8:58
feedback
up vote 0 down vote

Do I even need to do this?

You shouldn't need a rule to do this. Your system normally will ignore packets not addressed for it. Unless your system is setup for bridging, or routing.

If you did want to block traffic, you should explicitly allow your IP address, and then simply set the policy of the table to DROP.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.