Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to block all traffic that is both coming and going to an internal IP address (this server acts as a router for the network). so far I have tried the following: iptables -A INPUT -s -j DROP & iptables -A OUTPUT -d -j DROP, with being the IP address I am trying to block traffic from. The local area network connects to br0. Here is my current iptables setup (I've removed port forwards, etc to make it easier to go through):

# Generated by iptables-save v1.4.8 on Sat Feb 16 21:21:16 2013
:PREROUTING ACCEPT [184556:41149689]
:POSTROUTING ACCEPT [13698:835740]
:OUTPUT ACCEPT [77252:6378101]
# Completed on Sat Feb 16 21:21:16 2013
# Generated by iptables-save v1.4.8 on Sat Feb 16 21:21:16 2013
:INPUT DROP [10054:2687428]
:FORWARD ACCEPT [1377:76856]
-A INPUT -s -i br0 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A FORWARD -i eth0 -o Br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o eth0 -j ACCEPT
# Completed on Sat Feb 16 21:21:16 2013

How could I go about blocking all traffic to and from an IP with this current setup? Im not the best in the world with iptables, so any help would be much appreciated, thanks!

share|improve this question
Is the iptables rules you posted for the linux router and you are trying to block traffic to/from another machine inside the network? Please clarify. – Daniel t. Feb 17 '13 at 3:03
@Danielt. yep the iptables is located on the debian router, and I am trying to block internet traffic to/from a machine on the internal network – lacrosse1991 Feb 17 '13 at 3:15
up vote 2 down vote accepted

The INPUT and OUTPUT iptables chains apply to traffic destined to the local server. Any packet routed through the firewall is processed by the FORWARD chain. So in this case, you need to prevent packets from being forwarded by the linux router to the internal client using the FORWARD chain.

I would advise you to start with a default DROP policy for the FORWARD chain. Because your current setup shows that by default your FORWARD policy is ACCEPT, which is not the most secure setup. So start with a drop policy for forward with -

  iptables -P FORWARD DROP

Then allow packets to be forwarded to the Internal clients with -

  iptables -A FORWARD -s source-net/subnet -d destination-net/subnet -j ACCEPT
  iptables -A FORWARD -m state –state NEW,ESTABLISHED -s source-net/subnet -j ACCPET
  iptables -A FORWARD -m state –state ESTABLISHED -j ACCEPT

If the internal client is within the allowed subnet, set a rule to explicitly drop the packets destined to that client -

   iptables -I FORWARD -s 0/0 -d -j DROP
   iptables -I FORWARD -s -d 0/0 -j DROP
share|improve this answer
worked perfectly, thanks! – lacrosse1991 Feb 17 '13 at 21:55

The mistake you did was that you did append (-A) the blocking rules for instead of inserting it (-I), because if you pay attention some rules in INPUT/OUTPUT did allow traffic from 192.168.1.X segment. So do this:

iptables -I INPUT -s -j DROP
iptables -I OUTPUT -d -j DROP

If the is using the same server as an router than add a similra rule to the FORWARD chain

iptables -I FORWARD -d -j DROP

share|improve this answer
was an excellent solution, thanks! – lacrosse1991 Feb 17 '13 at 21:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.