Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server running CentOS 5.5 and acting as an OpenVZ host. One of the containers has been sending out spam and I need to block his ability to connect to outbound port 25. I've looked at http://wiki.openvz.org/Setting_up_an_iptables_firewall, but this setup is to prevent INCOMING traffic and I have not found a working IPTABLES rule that prevented a specific IP address from connecting to an OUTBOUND port.

I've tried:
iptables -I OUTPUT --source [CONTAINER_IP] --protocol tcp --destination-port 25 -j DROP
but that does not appear to actually block it. Any ideas would be appreciated.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

The OUTPUT table is used for sending traffic originating from the host. With Virtualization I'm not sure if the traffic uses the OUTPUT chain, or as it's being routed from a virtual device through the host, it may use the FORWARD chain instead. Try replacing OUTPUT with FORWARD in your rule.

share|improve this answer
    
That worked. Thanks –  John P Jun 10 '11 at 1:37
add comment

Kyle Smith's answer is correct with small notice: this rule must be placed defore any other FORWARD rules:

iptables -L

Chain FORWARD (policy ACCEPT)

target prot opt source destination

DROP tcp -- [CONTAINER_IP] anywhere tcp dpt:smtp

RH-Firewall-1-INPUT all -- anywhere anywhere

/etc/sysconfig/iptables

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

/* Block outgoing 25 port for containers */

-A FORWARD -p tcp --destination-port 25 -s [CONTAINER_IP] -j DROP

/* Main config */

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

share|improve this answer
    
More specifically it needs to be placed before any DROP rules that would block it. –  Kyle Smith Jun 10 '11 at 12:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.