Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured Ubuntu machine as router. Steps of NAT configuration are given below:

        #iptables -F
        #iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
        #iptables-save > /etc/network/iptables

Then kept this file location in rc.local

#vi /etc/rc.local

#!/bin/sh -e


# rc.local


# This script is executed at the end of each multiuser runlevel.

# Make sure that the script will "exit 0" on success or any other

# value on error.
/sbin/iptables-restore < /etc/network/iptables

# In order to enable or disable this script just change the execution
# bits.
# By default this script does nothing.

exit 0


It works, Now I want to block an ip address. To do this, I have executed following command:

#iptables -A INPUT -s -j DROP
#iptables-save > /etc/network/iptables

But it does not work.

#vi /etc/network/iptables now look like this:

# Generated by iptables-save v1.4.4 on Tue Feb 14 11:21:16 2012




:OUTPUT ACCEPT [461:28753]


# Completed on Tue Feb 14 11:21:16 2012

# Generated by iptables-save v1.4.4 on Tue Feb 14 11:21:16 2012


:INPUT ACCEPT [4914:3254723]

:FORWARD ACCEPT [2382:1222521]

:OUTPUT ACCEPT [4010:410041]



# Completed on Tue Feb 14 11:21:16 2012

What am I missing to block an ip address?

share|improve this question
After you execute this what is the output of iptables -L -v -n? –  Mark Wagner Feb 14 '12 at 8:44
Are you trying to block the IP from connecting to the machine? Or from routing through the machine? The INPUT chain is only for packets that are delivered locally. (Check ip route show table local to see what is local.) –  David Schwartz Feb 14 '12 at 8:49

3 Answers 3

up vote 3 down vote accepted

If you want to block an IP from using the MASQUERADE rule you need to put that rule in the FORWARD chain, not the INPUT chain.

iptables -I FORWARD -s -j DROP
share|improve this answer

I think the sequence is not correct.

What you are doing with append is putting it on the bottom of the chain. IPtables stops after the first match. So it can be that the rule is matched just before it hits the block rule. Make sure the blocking rule is on top. You can use the -I option to insert it at a specific spot in your chain.

share|improve this answer
While it is true that the order of rules in iptables matters, by the looks of it he only has one rule in them. The rest are just the policies, which always are shown first with iptables -S and always are evaluated last. –  G. Bach Feb 15 '12 at 10:25

iptables-save does not make your iptables rules persistent, so they will be lost after reboot. Instead, what it does is it prints your current iptables configuration to STDOUT (see manpages for iptables-save). So after your reboot, your iptables should be empty.

You probably want to restore your rules from that file after a reboot. To do so, use

iptables-restore < /etc/network/iptables

See manpages for iptables-restore on this.

As mentioned by Patrick, the rule

iptables -A INPUT -s -j DROP

will only prevent packets from being sent to the router itself - they will still be forwarded through if they are addressed correctly. To prevent that, add the rule

iptables -A FORWARD -s -j DROP

FORWARD is applied to packets the router wants to forward, while INPUT is applied to packets that are addressed to the router itself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.