Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running CentOS 5.5 and acting as an OpenVZ host. One of the containers has been sending out spam and I need to block his ability to connect to outbound port 25. I've looked at, but this setup is to prevent INCOMING traffic and I have not found a working IPTABLES rule that prevented a specific IP address from connecting to an OUTBOUND port.

I've tried:
iptables -I OUTPUT --source [CONTAINER_IP] --protocol tcp --destination-port 25 -j DROP
but that does not appear to actually block it. Any ideas would be appreciated.

share|improve this question
up vote 3 down vote accepted

The OUTPUT table is used for sending traffic originating from the host. With Virtualization I'm not sure if the traffic uses the OUTPUT chain, or as it's being routed from a virtual device through the host, it may use the FORWARD chain instead. Try replacing OUTPUT with FORWARD in your rule.

share|improve this answer
That worked. Thanks – John P Jun 10 '11 at 1:37

Kyle Smith's answer is correct with small notice: this rule must be placed defore any other FORWARD rules:

iptables -L

Chain FORWARD (policy ACCEPT)

target prot opt source destination

DROP tcp -- [CONTAINER_IP] anywhere tcp dpt:smtp

RH-Firewall-1-INPUT all -- anywhere anywhere





:RH-Firewall-1-INPUT - [0:0]

/* Block outgoing 25 port for containers */

-A FORWARD -p tcp --destination-port 25 -s [CONTAINER_IP] -j DROP

/* Main config */

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

share|improve this answer
More specifically it needs to be placed before any DROP rules that would block it. – Kyle Smith Jun 10 '11 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.