So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed.
We have found some scripts eg:
iptables -I FORWARD 1 -d $VPS_IP -p tcp -m tcp --dport 25 -j DROP
iptables -I FORWARD 1 -s $VPS_IP -p tcp -m tcp --dport 25 -j DROP
iptables -I FORWARD -p tcp --sport 25 -j DROP
iptables -I FORWARD -p tcp --dport 25 -j DROP
However controlling the blocking via the first set is inefficient, especially when the range of IPs can be changing.
So the question is, if we use set 2 (blanket block), how do we allow certain IPs? I'm guessing we need to add something to the OUTPUT chain, however wouldn't the blanket block be processed first? Or if we add to FORWARD, since they are further down the chain, wouldn't the blanket block go first? etc..
The iptables -L looks like:
[root@server ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination SOLUSVM_TRAFFIC_IN all -- anywhere anywhere SOLUSVM_TRAFFIC_OUT all -- anywhere anywhere all -- somedomain anywhere all -- anywhere somedomain Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain SOLUSVM_TRAFFIC_IN (1 references) target prot opt source destination all -- anywhere somedomain Chain SOLUSVM_TRAFFIC_OUT (1 references) target prot opt source destination all -- somedomain anywhere
Much appreciated! (going to post a job on coders for hire or something if it isn't answered)