I nat all tcp to a socks proxy doing something like..

sudo iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner USER -m tcp -j REDIRECT --to-ports XXX

Therefore all packets go there, it works.

I know that local socks proxy connect to a IP and I want to allow my computer to access only that IP. The way I try to do it is..

sudo iptables -P OUTPUT DROP

then I add an exception

sudo iptables -A OUTPUT -o lo -d -j ACCEPT (loopback)
sudo iptables -A OUTPUT -d xxx.yyy.xxx.zzz -j ACCEPT

I have used wireshark to see if my computer connects to another IP but it only connects to that IP but somehow when I say to iptables DROP everything except that one with ALL protocols allowed and ALL ports, it is not working. I really cant understand it.

  1. Use "-v, --verbose", you see iptables counter. This is a good tool for debugging.
  2. Use LOG target to debug iptables rules.

I think you should add that drop-rule at the end because it's first processed if you added it first. And since all packets match that drop-rule, all further rules will be ignored.

  • -P sets the policy for the chain, it's not a rule in the chain. – Nathan Powell Jul 9 '11 at 11:46
  • oh yes... must have been sleeping – wullxz Jul 11 '11 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy