Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup IPTABLES on my xen host server that will block incoming and/or outgoing access to a xen client on the same machine. Specifically, I need to block outgoing port 25 traffic and incoming port 53 traffic to a specific container.

Regular IPTABLE rules only appear to affect traffic going to the host -- not the xen client.

For my server, eth0 is the internal network, eth1 is the external.

The following rule set seems like it should work, but the container is not affected at all:

iptables -A OUTPUT -p tcp -m state –state NEW,ESTABLISHED,RELATED –sport 25 -d  -j REJECT
iptables -A INPUT -p tcp -m state –state NEW,ESTABLISHED,RELATED –dport 53 -d  -j REJECT
iptables -A INPUT -p udp -m state –state NEW,ESTABLISHED,RELATED –dport 53 -d   -j REJECT

So basically, how do I setup an IPTABLE rule that will apply to the xen client instead of the xen host?


share|improve this question
Provided that the vm is using it's own IP, you should do all the filtering in the FORWARD chain, not the INPUT/OUTPUT (such behaviour would have worked with ipchains but is not valid for netfilter). –  O G Aug 17 '11 at 5:40
I tried the following (to block all traffic to a client) and it did not work: -A FORWARD -p tcp -m state --state NEW,ESTABLISHED,RELATED -d [CLIENT_IP] -j REJECT –  John P Aug 17 '11 at 6:45
Can you provide some details on hosts and vm's network configuration (substitute the first 3 bytes in each ip with 1.2.3 for privacy, but provide interface names and correct masks)? –  O G Aug 17 '11 at 6:59

2 Answers 2

This rule worked ion my installation:

iptables -I FORWARD 1 -d [client-ip] -p tcp -m tcp --dport 53 -j DROP
iptables -I FORWARD 1 -d [client-ip] -p udp -m udp --dport 53 -j DROP

Notice that netfilter reads rules top-to-bottom and if you have a rule permitting all traffic to this client above (iptables -A adds rule to the end of the table), this new rule won't be reached and won't have effect.

I didn't understand why you use "state" module if you a listing all valid states? It just uses CPU time and has no effect IMHO.

Next, I'm not sure, what is the goal of blocking traffic, going from port 25. If you client sends ab e-mail, he connects to remote server's port 25 but uses one of local ports (32k..64k by default) on his side. Couldn't you explain, what do you want to get as a result?

share|improve this answer
My goal with the port 25 rule is to prevent a container from sending sending email –  John P Aug 17 '11 at 11:55
Then you should forbid destination port 25. –  HUB Aug 17 '11 at 13:03
Ex. iptables -I FORWARD 1 -s [client-ip] -p tcp -m tcp --dport 25 -j DROP –  HUB Aug 17 '11 at 13:04

I rarely try to block DomU VM's so I can't tell you exactly what to do. But please refer to this page:


especially the "Bridging" section. There are some iptables examples there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.