up vote 4 down vote favorite
share [g+] share [fb]

I'm quite new to Linux and using iptables. Here is what I am trying to accomplish:

  1. I have an ASP.net client that talks with a web service hosted through web-logic on linux. The communication is over SSL.

  2. What I am trying accomplish using iptables is only block the response back to the client.

  3. So the client makes a web service call, the web service processes the request and replies back to the client.

  4. I want the web service to receive the request but block its response back to the client.

What I did for test purposes was flush all the rules from iptables. I created default policies for ACCEPT on the INPUT, OUTPUT and FORWARD chains. Next I added a rule to the OUTPUT chain to DROP anything which has the source IP of the client.

iptables -A OUTPUT -s client_ip_address -j DROP

Apparently, this made no difference. I can call the web service from the client and still receive a response.

Any help is appreciated?

link|improve this question
Don't you want -s client_ip_address to be -d client_ip_address, since you want to block connecting out to the client? – Dan Fego Feb 1 at 16:19
I tried that as well but doesn't work. Also I'm not sure that it should be the destination (-d) because the TCP stream is not originating from the host which has the web service. The response would go back on the same TCP stream that originating from the client so I am thinking I would want to block the output to that source. Am I making sense here? – IceFossil Feb 1 at 16:30
I'm just digging here, but what if you try adding --state ESTABLISHED? (I'd say with -d, but you can also try -s). – Dan Fego Feb 1 at 16:34
2  
If you block the response, the HTTP user agent will ultimately hang. What's the point of doing that? – jørgensen Feb 1 at 16:35
1  
@j0rgensen ... thats exactly what I am trying to test. Timeout situations or hangs when it does not get a response. – IceFossil Feb 1 at 16:40
show 2 more comments
feedback

migrated from stackoverflow.com Feb 1 at 20:27

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 4 down vote

It depends on what exactly do you want to accomplish. If you want to simulate network timeout use this:

iptables -A OUTPUT -d clientip  -j DROP

it will silently drop all packets from the server to the client.

If you want to let tcp handshake happen and then to kill the connection (might be useful or you can just activate the above rule later) use this:

iptables -A OUTPUT -d clientip -p tcp --tcp-flags SYN,ACK SYN,ACK -j ACCEPT
iptables -A OUTPUT -d clientip  -j DROP

If you want to simulate closed port (service not running) use:

iptables -A INPUT -s clientip  -j REJECT

it will send ICMP Destination unreachable message back to the client.

Hope it helps.

link|improve this answer
feedback
up vote 0 down vote

@Gregy ... What I want to do is receive only on the TCP pipe and not send the response. I tried your examples but to no avail. Maybe what I am trying to do is not possible or still having got the right ingredient in the mix.

link|improve this answer
feedback
up vote 0 down vote

It's possible that you have a rule earlier in the OUTPUT chain that allows all ESTABLISHED and RELATED connections - this is quite common. If such a rule is there, it will be matched before a DROP rule you put in with -A. Try putting your DROP rule as early as possible in the OUTPUT chain:

iptables -I OUTPUT -d clientip  -j DROP

will put the rule at the very top of the chain.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard