Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm quite new to Linux and using iptables. Here is what I am trying to accomplish:

  1. I have an client that talks with a web service hosted through web-logic on linux. The communication is over SSL.

  2. What I am trying accomplish using iptables is only block the response back to the client.

  3. So the client makes a web service call, the web service processes the request and replies back to the client.

  4. I want the web service to receive the request but block its response back to the client.

What I did for test purposes was flush all the rules from iptables. I created default policies for ACCEPT on the INPUT, OUTPUT and FORWARD chains. Next I added a rule to the OUTPUT chain to DROP anything which has the source IP of the client.

iptables -A OUTPUT -s client_ip_address -j DROP

Apparently, this made no difference. I can call the web service from the client and still receive a response.

Any help is appreciated?

share|improve this question

migrated from Feb 1 '12 at 20:27

This question came from our site for professional and enthusiast programmers.

Don't you want -s client_ip_address to be -d client_ip_address, since you want to block connecting out to the client? – Dan Fego Feb 1 '12 at 16:19
I tried that as well but doesn't work. Also I'm not sure that it should be the destination (-d) because the TCP stream is not originating from the host which has the web service. The response would go back on the same TCP stream that originating from the client so I am thinking I would want to block the output to that source. Am I making sense here? – IceFossil Feb 1 '12 at 16:30
I'm just digging here, but what if you try adding --state ESTABLISHED? (I'd say with -d, but you can also try -s). – Dan Fego Feb 1 '12 at 16:34
If you block the response, the HTTP user agent will ultimately hang. What's the point of doing that? – jørgensen Feb 1 '12 at 16:35
@j0rgensen ... thats exactly what I am trying to test. Timeout situations or hangs when it does not get a response. – IceFossil Feb 1 '12 at 16:40

It depends on what exactly do you want to accomplish. If you want to simulate network timeout use this:

iptables -A OUTPUT -d clientip  -j DROP

it will silently drop all packets from the server to the client.

If you want to let tcp handshake happen and then to kill the connection (might be useful or you can just activate the above rule later) use this:

iptables -A OUTPUT -d clientip -p tcp --tcp-flags SYN,ACK SYN,ACK -j ACCEPT
iptables -A OUTPUT -d clientip  -j DROP

If you want to simulate closed port (service not running) use:

iptables -A INPUT -s clientip  -j REJECT

it will send ICMP Destination unreachable message back to the client.

Hope it helps.

share|improve this answer

It's possible that you have a rule earlier in the OUTPUT chain that allows all ESTABLISHED and RELATED connections - this is quite common. If such a rule is there, it will be matched before a DROP rule you put in with -A. Try putting your DROP rule as early as possible in the OUTPUT chain:

iptables -I OUTPUT -d clientip  -j DROP

will put the rule at the very top of the chain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.