I have a router/gateway that is I have a server running Ubunutu server 16.04 with 3 interfaces. ens3 = (outside) ens4 = (inside) ens5 = (not used yet) I added one nat table rule to SNAT the ens3 outside interface.

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 SNAT       all  --  any    ens3    anywhere             anywhere             to:

using a laptop I set my default gateway to and ip to and I am able to ping all server interfaces, the router and out to the internet.

I added a filter rule to drop based on destination ip

Chain OUTPUT (policy ACCEPT 23 packets, 2564 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  any    any     anywhere   

from the server trying to go to that IP, the rule blocks my connection and records count properly, but from my laptop connecting at ens4 I can make it to the site and it does not get blocked.

What am I missing?


OUTPUT-chain is for packets originated from server itself. Clients' packets should be blocked on FORWARD-chain. Something like this: iptables -I FORWARD -d -j DROP.

  • OMG, thank you so much for this, I was beating my head trying to figure this out and I knew it was going to be something simple. Thanks for the answer and explaining the packet routing better. – omgimdrunk Feb 18 '17 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.