Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to learn about Iptables. I've looked at a few sources and they say that I can block a subnet by doing something like

iptables -A OUTPUT -s -j DROP

which leaves me with something like,

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 
DROP       all  --       anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --       anywhere            

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere  

However traffic from that subnet is still getting through.

Why? Thanks in advance!

share|improve this question
up vote 3 down vote accepted

Your rule is correct if you want to block outgoing traffic from the firewall machine (originated from firewall machine itself) which does not make much sense to block subnet originating from one machine!!

I think you want to block traffic coming from some subnet and getting through the firewall. In this case, you need to add the rule to the FORWARD chain NOT to the OUTPUT chain.

Here is the rule:

iptables -A FORWARD -s -j DROP
share|improve this answer
Thanks very much that fixed it. Thanks! – Andrew Aug 16 '12 at 12:22
Shouldn't iptables -A INPUT -s -j DROP be also added? – user130370 Aug 16 '12 at 14:06
@EricDANNIELOU: So, this will deny any access to the firewall machine from the same subnet. – Khaled Aug 18 '12 at 6:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.