1

I'm trying to block outgoing traffic for a specific host and port.

iptables command I'm using is:

iptables --wait --append OUTPUT --jump DROP --source 192.168.136.216 --destination 192.168.137.156 --out-interface enp12s0f0 --protocol tcp --dport 15900

Then I start netserver on 192.168.137.156 and start netperf locally:

netperf -H 192.168.129.156,inet -l 2 -t TCP_STREAM -- -H 192.168.129.156 -L 192.168.128.216 -P ,15900

Netperf finish with success and I can sniff packets on my netserver host:

11:44:48.697129 IP 192.168.128.216.62395 > 192.168.129.156.15900: Flags [S], seq 162822509, win 29200, options [mss 1460,sackOK,TS val 180200064 ecr 0,nop,wscale 7], length 0

Why outgoing traffic not being blocked? Is this iptables command wrong?

  • I was afraid that it may be because of way netperf is implemented (e.g. Python Scapy is so low level that you can read packets before iptables will be applied to them) but I wrote simple Python client/server script and it is not blocked as well. – Mateusz Kosturek Nov 23 '17 at 15:08
  • Is there an earlier rule that is accepting/allowing the traffic? – Jeff Schaller Nov 23 '17 at 15:13
  • No, I flushed iptables before this and then created the only one OUTPUT DROP rule. Also if it is helpful it is Red Hat Enterprise Linux Server release 7.4 (Maipo), kernel 3.10.0-693.el7.x86_64 – Mateusz Kosturek Nov 23 '17 at 15:21
  • Can you add your routing table and network interfaces (e.g. ip route and ip addr or route -n and ifconfig)? – igal Nov 23 '17 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.