Stephen Harris wrote:

On Mon, Apr 25, 2011 at 06:03:29PM +0200, Alexander Farber wrote:

...

Hello,

how do you block incoming AND outgoing traffic to a site?

I have 2 drop lines for a site in my /etc/sysconfig/iptables:

*filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [294:35064] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -s xx.xx.xx.0/24 -j DROP -A INPUT -d xx.xx.xx.0/24 -j DROP -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp -m multiport --dports 80,8080 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/min --limit-burst 2 -j ACCEPT COMMIT

but for some reason still can "ping xx.xx.xx.1" and "ssh xx.xx.xx.1" prints "ssh: connect to host xx.xx.xx.1 port 22: Connection refused" immediately, which probably means my packets aren't dropped at all.

To block outgoing traffic (traffic originating on this host destined for another machone) you need to add rules to the OUTPUT filter.

Meaning: -A INPUT -s xx.xx.xx.0/24 -j DROP -A OUTPUT -d xx.xx.xx.0/24 -j DROP

Ljubomir

There's a number of diagrams around the Internet illustrating the path packets take through the Linux kernel, including the various firewall modules, that's quite helpful in understanding which rules should go in which table.

Here's one that's not bad:

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables#Figure_14-1_Iptables_Packet_Flow_Diagram

The box labeled "Local Processing of Data" is where packets that are created by the firewall's applications originate.

Does anyone have a better diagram? How about one that shows the policy routing system?