Re: Vijay - port 25 to be blocked

[Javier Sanchez <sjllera@ya.com>]

You are using INPUT, and should be using the OUTPUT chain because you
need to filter traffic comming from an external network. You can also
put the filter on the INPTU chain, in this case you shuld use --sport
instead of --dport.


So it should be:

To filter incoming traffic from a forbidden mail server.

iptables -I INPUT -i eth0 --sport 25 -d  !<ip addr of mail server>  -j
REJECT

To filter outgoing traffic to a forbidden mail server.

iptables -I OUTPUT -o eth0 --dport 25 -d  !<ip addr of mail server>  -j
REJECT

You should use the second option, but depend on your firewall ruleset
implementation, any of them will do the trick .-)

Cheers

El mar, 28-12-2004 a las 21:52 +0530, Vijay Kumar escribió:
> Hi,
> 
> I want to allow my internal network to only connect to some specific email
> servers.
> Apart from these mail server  I want to block port 25 and 110 from my
> internal network to anywhwere. I am doing the following : 
> 
> iptables -I INPUT -I eth0 --dport 25 -d  !<ip addr of mail server>  -j
> REJECT  
>  
> This does not seem to block the port 25 traffic. Where am I going wrong? 
> 
> Kindly help. 
> 
> Regards,
> Vijay Kumar
> 
>  
> 
> 
>