Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I setup an iptable setting to drop all IP packets that don't have my IP address on it? (do I even need to do this?)

This is the closest I can think of, but I think it doesn't quite work because I somehow need to be able to specify NOT destination AND source.

* filter

-A INPUT -i eth0 -d ! -j DROP

share|improve this question
up vote 3 down vote accepted

You don't need to do this; the networking stack ignores packets that aren't destined for your machine. Only hosts on your local network would be able to send you packets with the wrong destination address anyway. This would also block broadcasts, which may be a problem.

share|improve this answer
Well that's what I am thinking, but when I am running a screen session, sometimes my bandwidth meter goes way up. When I run iftop default (nonpromiscous mode) it shows other people's packets. Maybe this has to do with being on a Xen share? – Unknown Jun 6 '09 at 6:51
This is entirely possible. Xen tends to do some funny things to networking. – David Pashley Jun 6 '09 at 6:58
@David, I think i may be on a hub instead of a switch. Do I need any iptable filters if this is the case? – Unknown Jun 6 '09 at 8:40
Nope, your networking stack still won't accept the packets and will just ignore them. – David Pashley Jun 6 '09 at 8:58

Do I even need to do this?

You shouldn't need a rule to do this. Your system normally will ignore packets not addressed for it. Unless your system is setup for bridging, or routing.

If you did want to block traffic, you should explicitly allow your IP address, and then simply set the policy of the table to DROP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.