0

I am trying to Add Reject Rule for Outgoing traffic but I want to exclude one specific Ip address so that I can ssh. I tried adding two different rules

  1. sudo iptables -A OUTPUT -p tcp -d x.x.x.x/32 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
  2. sudo iptables -A OUTPUT -p tcp -d x.x.x.x/22 -j REJECT --reject-with tcp-reset

I tried changing the order of rules but still I am unable to overide "Reject" Rule and ssh into x.x.x.x/32 server

Improve this question
5
  • 2
    you should give the whole ruleset, in case something else than just these two rules is at play: iptables-save -c. – A.B Oct 6 '20 at 22:49
  • Hi A.B, thanks for taking a look.. I tried saving iptables rule but that didn't help :( – Harry Oct 7 '20 at 16:56
  • 1
    You didn't get it: iptables-save -c 's output: your rules, should be provided in this question (by editing it) so people can help you with an answer. – A.B Oct 7 '20 at 16:58
  • 1. sudo iptables -A INPUT -p tcp -d x.x.x.x/32 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2. sudo iptables -A OUTPUT -p tcp -d x.x.x.x/32 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 3. sudo iptables -A OUTPUT -p tcp -d x.x.x.x/29 -j REJECT --reject-with tcp-reset I did it ... Thank you – Harry Oct 7 '20 at 17:11
  • Please add the output to the question in a code block, it is not readable from a comment. – Tero Kilkanen Oct 7 '20 at 20:53
0

Remove previous broken rules, and try this (it worked for me):

$ sudo iptables -A OUTPUT -p tcp ! -d x.x.x.x/32 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j DROP

This means that if the outgoing traffic is SSH (TCP 22) but not destined to x.x.x.x/32, drop the traffic.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.