Linux – Using iptables to block ALL outgoing traffic from one NIC

iptableslinuxlinux-networkingrouter

I must pretty bad at Googling as this seems like a very basic question but I can't seem to find the answer anywhere… and man iptables is a very long read!

I have two NICs – eth0 and eth1 – on a linux box and I want to block ALL outbound traffic (TCP and UDP across all ports) from one of the NICs, so that no traffic makes its way back up to the router.

What is the command for this? I have only seen examples with specific ports.

Thanks in advance.

Best Answer

With iptables -A OUTPUT -o eth1 -j DROP you can drop all outgoing traffic on interface eth1. You'll probably also want to drop all forwarded traffic using iptables -A FORWARD -o eth1 -j DROP.

Related Solutions

Iptables rule to block incoming/outgoing traffic to a Xen container

This rule worked ion my installation:

iptables -I FORWARD 1 -d [client-ip] -p tcp -m tcp --dport 53 -j DROP
iptables -I FORWARD 1 -d [client-ip] -p udp -m udp --dport 53 -j DROP

Notice that netfilter reads rules top-to-bottom and if you have a rule permitting all traffic to this client above (iptables -A adds rule to the end of the table), this new rule won't be reached and won't have effect.

I didn't understand why you use "state" module if you a listing all valid states? It just uses CPU time and has no effect IMHO.

Next, I'm not sure, what is the goal of blocking traffic, going from port 25. If you client sends ab e-mail, he connects to remote server's port 25 but uses one of local ports (32k..64k by default) on his side. Couldn't you explain, what do you want to get as a result?

Linux – One-to-One NAT using Linux IPTables Not Working

You need to confirm you have the following conditions met:

Enable the IP forwarding using: echo 1 > /proc/sys/net/ipv4/ip_forward or by setting the appropriate line in /etc/sysctl.conf.
Allow the traffic to pass through the box which should be OK according to your description.
Setup the needed NAT rules which should be OK according to your description.
Setup the needed routes (static or dynamic) if the routed IPs belong to subnets not directly connected to the Linux router. This should be also OK according to your description.

It seems that you are left with the first point!

Best Answer

Related Solutions

Iptables rule to block incoming/outgoing traffic to a Xen container

Linux – One-to-One NAT using Linux IPTables Not Working

Related Topic