Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination                  
DROP       all  --         anywhere  

I have right now this active rule. However as you can figure out, it isn't working because I'm writing this question. If I add the rule to the INPUT chain, it works perfectly.

Initially I thought aaa of course, it isn't working because it's asking DNS for, so I added the rule iptables -A OUTPUT -s -j DROP, but still the same.

Why is iptables allowing outgoing packets to this web?

share|improve this question
Is it all you got in output chain? are there any other rules? – Hex Jan 21 '13 at 23:00
Only this one. I started today with iptables and I've been checking out how it works. – yzT Jan 21 '13 at 23:00
Check out my answer. – Hex Jan 21 '13 at 23:03
up vote 3 down vote accepted

As far as I can understand you dont want to allow your server to connect to that ip so it should be dst not src.

iptables -A OUTPUT -d -j DROP

share|improve this answer
ok! problem of misunderstanding. I didn't notice about the -d. – yzT Jan 21 '13 at 23:05
No problems, glad you fix it :) – Hex Jan 21 '13 at 23:05

You are blocking packets with a source address of you need to block packets with a destination address of

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.