(Centos 5.5) to block xxx.xxx.xxx.xxx:

# iptables -A OUTPUT -j DROP -d xxx.xxx.xxx.xxx

then verify by:

# iptables -L OUTPUT --line-numbers

Chain OUTPUT (policy DROP)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
3    DROP       all  --  anywhere             xxx.xxx.xxx.xxx

It doesn't work; what did I do wrong?

1 Answer 1


You have the ACCEPT from anywhere to anywhere first in the table, so that matches and your DROP rule is never reached.

Use -I instead of -A in this case to insert the rule at the head of the table.

Note that when writing scripts it's generally preferable to use -A as then the rules are added in the same order as they're listed in the script.

  • Additionally, incoming connections from the "blocked" IPs will still allow outgoing communication as they'll match the NEW,RELATED,ESTABLISHED rule.
    – wraeth
    Commented Mar 5, 2015 at 10:01
  • thanks I'll remove the rule and try -I. I see, so the ACCEPT all rule should be always at the end when blacklisting ip/port Commented Mar 5, 2015 at 10:04
  • @cidfenmaria If blacklisting specific addresses but allowing all others, yes (or just have the OUTPUT policy set to ACCEPT). If blacklisting all but allowing specific addresses, the final rule would be DROP (or, again, use the policy, but be careful if doing this over ssh). Each rule is processed, in order, from top to bottom, until it jumps to a DROP, REJECT or ACCEPT action.
    – wraeth
    Commented Mar 5, 2015 at 11:02
  • I've made changes and after a few days and run #netstat -n | grep <ip address I blocked>. the ip still exist? tcp 0 1 <host ip>:44760 <blocked ip>:6667 SYN_SENT Commented Mar 9, 2015 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .