I am new to iptables and networking in general, so I am experimenting with it.

I am learning how to close ports; in particular I am trying to close a specific port on the host machine, so another machine on the network won't receive packets.

I would like to drop outgoing traffic on port 22, so it is not possible to ssh to a machine ( from a specific machine (

I wrote this rule on the machine from which I want to drop traffic (

iptables -I OUTPUT -s -p tcp --dport 22 -j DROP

So far I get no errors, but when I try to ssh into this machine, I can do so without problems.

I thought that my rule says "drop all packets in output, directed to that IP, on that port"; which would make impossible to start a ssh connection, since it runs on port 22.

What am I missing? How do I check that the rule is in fact working?

EDIT: Thanks for the comment, I see that I used s instead of d; which is probably why it won't work.

  • 1
    Did you reload the iptables, as with service iptables restart?
    – JRFerguson
    Jun 15, 2015 at 18:31
  • I did not. I was not aware that it needs to restart. But even when I restart iptables I can still ssh in the machine. Thanks!
    – rataplan
    Jun 15, 2015 at 18:32
  • 1
    You don't need to reload iptables, but: please spell out which system you want to block, which system you ran the command on, and which system has the IP Name them, if it helps. Because, as it stands, I think you should have use -d (destination) instead of -s (source).
    – muru
    Jun 15, 2015 at 18:37
  • Sorry if it was not clear; updating the question now.
    – rataplan
    Jun 15, 2015 at 18:38
  • 1
    If you want to drop locally-generated packets on the machine to destination port 22 you should check the source IP of your rule. You've provided which is obviously not the source IP on the machine with the IP
    – FloHimself
    Jun 15, 2015 at 19:06

3 Answers 3


Maybe someone has a better answer, but here are mine.

  1. Create an identical rule but one whose target is LOG rather than ACCEPT or DROP etc. That rule comes before the one you want to test.

    iptables -I OUTPUT -s -p tcp --dport 22 -j LOG --log-level info 

    You can find the log output wherever you have kernel logs directed to. (If you don't know, that's another question.) Use tail -f on that file as you are attempting to reach the port from the other host.

  2. After the rule is in place and as /u/richard suggested, you used nmap or some other tool to try to reach the tested port, run iptables with -v and -x options to see the exact counts of packets that have hit each rule. I use:

    iptables -L OUTPUT -nvx

    Let's say the rule is #6 in the list. You can monitor just that one using the handy watch program:

    watch -n 0.5 iptables -L OUTPUT 6 -nvx

    which will update the display every 1/2 second.


To see which rules have been matched for an incoming request in details, iptables has the powerful TRACE target,
Document sums it up the best:

This target marks packes so that the kernel will log every rule which match the packets as those traverse the tables, chains, rules.
It can only be used in the raw table.

In your case just do:

iptables -t raw -A PREROUTING -s -p tcp --dport 22 -j TRACE

Every TCP packet coming from to port 22 of the system, will be marked so every rule that applies to it would be logged in kernel logs.
To use it the TRACE have be added to raw table containing the chain PREROUTING.

If you wanna know how a packet flows through iptables tables and chains see the picture: Path of packets moving throught iptables

If you need better understanding of what are tables, chains and etc see here


To test incoming connections: nmap is a good tool, you need to run it on another machine. Zenmap is a graphical user interface for nmap. You can use it to scan for open ports etc.

As for blocking a specific port of ip, these are easily changed. If you stop me using port 22, then I will add my ssh server to another port.

Usually you want to block everything except what you need.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .