Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to simulate a DMZ like scenario where server1(inside DMZ, should be able to respond to any incoming connection and cann't make a new outgoing connection on its own.

I would appreciate if someone provides a working example.


I am doing a simple test. I am accessing the webpage hosted at from So if this rule were to allow all incoming and only related/established outgoing I should be able to open the webpage and do all stuff on that. But with this rule I am not able to access the webpage. If I do nc -v 80 from (server2). I am getting success and also could see incoming packets in tshark

I tried a iptables rule but it does not work the way I expect

-A OUTPUT -m state --state NEW -j DROP

Iptables -L -nv output

iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1375  142K ACCEPT     all  --  *      *             state NEW,RELATED,ESTABLISHED 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   480 REJECT     all  --  *      *             state NEW reject-with icmp-port-unreachable 
 1185 1346K ACCEPT     all  --  *      *             state RELATED,ESTABLISHED 


I am running CentOS 6.4.

share|improve this question
Your INPUT rules are a bit redundant at the moment, since everything is accepted on the first rule. I assume you're planning to change this eventually? – Paul Gear May 21 '13 at 20:32
You've also got a stray -m in your OUTPUT rule - where did that come from? Was this really created by system-config-firewall, or have you manually edited? – Paul Gear May 21 '13 at 20:34
Thanks I will update that. – chandank May 21 '13 at 21:09
Please provide the output of iptables -L -nv. Your rules look good to me. I guess there are more and those cause problems. Furthermore, quoting the man page: The "state" module is an obsolete version of "conntrack". – Hauke Laging May 21 '13 at 21:29
I have updated the question – chandank May 21 '13 at 22:01

A fairly generic answer (i'm sure there are better ones elsewhere on serverfault if you search) is: if iptables isn't working as you expect, you should:

  • add logging rules at appropriate points and watch the log as you generate the traffic
  • watch the counters on your rules with iptables -L -n -v as you generate the traffic
  • and (my favourite) use an iptables preprocessor like Shorewall to do the heavy lifting of creating the rules for you
share|improve this answer
Thanks for reply, but a working example will be helpful – chandank May 21 '13 at 21:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.