Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm pretty new to IPTables, and I can't figure out how to write an ACCEPT rule for a specific site on a given port on a proxy server.

No matter what I try, the packets get dropped, kern.log shows the following entries when I test access to the target website :

deny-output IN= OUT=eth1 SRC=a.a.a.a DST=y.y.y.y LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=59767 DF PROTO=TCP SPT=48204 DPT=2096 WINDOW=5840 RES=0x00 SYN URGP=0

I tried adding the following rules :

iptables -p tcp -A POSTROUTING -s x.x.x.x --sport 1:65535 -d 0/0 --dport 1:65535 --syn -j MASQUERADE -o eth1 -t nat
iptables -m state --state NEW -p tcp -A FORWARD -d y.y.y.y --dport 2096 --syn -j ACCEPT -i eth0 -o eth1
iptables -m state --state NEW -p tcp -A FORWARD -d y.y.y.y --dport 2096 --syn -j ACCEPT -o eth1
iptables -m state --state NEW -p tcp -A FORWARD -d y.y.y.y --dport 2096 --syn -j ACCEPT -o eth1

Any help, advice, tip, whatever, will be welcomed.

share|improve this question
You're adding rules to the POSTROUTING and FORWARD chain, but your packet is getting dropped from "deny-output" on the OUT of the eth1 interface. Are you sure you're not blocking the output somewhere else on the OUTPUT chain? –  gparent Mar 22 '12 at 15:48
Yes, the final rule is to REJECT all output. After listing the rules, I just realized there was a stupid typo in my init scripts, and so the rule never got applied. Thanks for your help. –  T. Fabre Mar 22 '12 at 16:12
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.