2

I've recently started blocking port 25 on OpenVZ 7 nodes, using the following rule:

iptables -I FORWARD -p tcp --dport 25 -j DROP

This works fine, but it seems to block both inbound and outbound, but I only want outbound to be blocked. Is this possible?

If it means anything, I use the following commands to open port 25 again for a specific IP address:

iptables -I FORWARD 1 -d 192.168.0.1 -p tcp -m tcp --dport 25 -j ACCEPT
iptables -I FORWARD 1 -s 192.168.0.1 -p tcp -m tcp --dport 25 -j ACCEPT
Improve this question
2
  • Docker containers (or classic VMs in NAT mode) are not affected from INPUT- or OUTPUT-table. They are forwarded over your host - and that is the reason why only FORWARD-rules changes the behavior.
    – akop
    Jun 19, 2020 at 20:04
  • I've deleted my answer because it was not helpful, as I read too fast and didn't notice we were dealing with containerization. Given the name of the interface in your container, you may have more luck with: iptables -A FORWARD -o docker0 -p tcp --dport 25 -j DROP, where docker0 if your interface name. As mentioned the traffic coming from the container goes through the FORWARD chain.
    – Kahn
    Jun 19, 2020 at 23:41

3 Answers 3

Reset to default
2

I've deleted my original answer because it was not helpful, as I read too fast and didn't notice we were dealing with containerization. The below comments can be ignored (unless you want to see how to log iptables activity).

Given the name of the interface in your container, you may have more luck with:

iptables -A FORWARD -o docker0 -p tcp --dport 25 -j DROP

Where docker0 if your interface name. As mentioned the traffic coming from the container goes through the FORWARD chain (again - containerization), so the OUTPUT and INPUT chains are not valuable here.

Improve this answer
7
  • I've just tried that rule (with no other iptables rules active), but both port 25 inbound and outbound were open.
    – user12207241
    Jun 19, 2020 at 18:14
  • Even still, what is the output of iptables -L?
    – Kahn
    Jun 19, 2020 at 18:19
  • [root@fife ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP tcp -- anywhere anywhere tcp dpt:smtp Chain SOLUSVM_TRAFFIC_IN (0 references) target prot opt source destination Chain SOLUSVM_TRAFFIC_OUT (0 references) target prot opt source destination [root@fife ~]#
    – user12207241
    Jun 19, 2020 at 18:29
  • Also, what means are you using to verify that port 25 is still pushing traffic out?
    – Kahn
    Jun 19, 2020 at 18:34
  • I tried sending an email out using cPanel Webmail (port 25) and it delivered fine. When I use the rule iptables -I FORWARD -p tcp --dport 25 -j DROP, it does not deliver.
    – user12207241
    Jun 19, 2020 at 18:43
1

I'm pleased to say that I've got this fully working, thanks to Kahn, here is the solution which should for others who are running OpenVZ 7:

Run the following:

iptables -A FORWARD -o br0 -p tcp --dport 25 -j DROP

This will drop outbound port 25 on br0 (the interface that VMs inherit)

Then, if it needs opening for a specific IP address, run:

iptables -I FORWARD 1 -s 192.168.0.1 -p tcp -m tcp --dport 25 -j ACCEPT

Improve this answer
1
  • 1
    I'm pleased it's working for you - would you be kind enough to accept my answer?
    – Kahn
    Jun 21, 2020 at 15:15
1

On Ubuntu 22.04 container (FROM ubuntu:jammy), I had to use the following

  • Add --cap-add=NET_ADMIN to the docker run command.

  • sudo iptables-legacy -A OUTPUT -o eth0 -p tcp --dport 25 -j DROP

without the iptables-legacy, I was getting a unknown option "--dport" without -A OUTPUT it still allowed the outbound port

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .