Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination                  
DROP       all  --         anywhere  

I have right now this active rule. However as you can figure out, it isn't working because I'm writing this question. If I add the rule to the INPUT chain, it works perfectly.

Initially I thought aaa of course, it isn't working because it's asking DNS for, so I added the rule iptables -A OUTPUT -s -j DROP, but still the same.

Why is iptables allowing outgoing packets to this web?

share|improve this question
Is it all you got in output chain? are there any other rules? – Hex Jan 21 '13 at 23:00
Only this one. I started today with iptables and I've been checking out how it works. – user149678 Jan 21 '13 at 23:00
Check out my answer. – Hex Jan 21 '13 at 23:03
up vote 3 down vote accepted

As far as I can understand you dont want to allow your server to connect to that ip so it should be dst not src.

iptables -A OUTPUT -d -j DROP

share|improve this answer
ok! problem of misunderstanding. I didn't notice about the -d. – user149678 Jan 21 '13 at 23:05
No problems, glad you fix it :) – Hex Jan 21 '13 at 23:05

You are blocking packets with a source address of you need to block packets with a destination address of

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.