0

I want to block the packets whose source ip is not localhost(172.17.7.1) when sending out. how to do this ? I write a rule like this

iptables -A OUTPUT -s !172.17.7.1 -J DROP 

it does not work`

2
  • Why are you saying that 172.17.7.1 is localhost? Localhost is the subnet 127./8, and only it. – whitequark Nov 25 '10 at 9:34
  • 172.17.7.1 is the gateway – larry Nov 25 '10 at 9:40
1

iptables -A OUTPUT -s ! 172.17.7.1 -j DROP

Use small caps "j" and append space after "!" sign, else it will be interpreted like a command from your shell history. Pay attention that you do apppend with A and not insert on the beginning of the chain.

3
  • thanks! can i add more conditions? for instance, block all the packets whose source ip is not localhost(172.17.7.1) and 58.30.30.3 – larry Nov 25 '10 at 9:34
  • For every one additional IP address you must use another rule. But you can use IP/mask syntax to get few addresses if they are at the same range. Dropping all the output traffic you are at risk, for example to drop your server DNS query or any other traffic that is needed for normal use. Do not use term like localhost for IP addresses assigned to your network card. – ntk Nov 25 '10 at 10:44
  • ntk, you are very nice, could you check this question out /? serverfault.com/questions/203324/… – larry Nov 25 '10 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.