Block outbound host to specific port using Masq./NAT?

Block outbound host to specific port using Masq./NAT?

[Jerry A. Applebaum]

Hello - this is probably a dumb question....I'm using iptables for my
home network (DSL) and I have masquerading, some port forwarding,
etc., etc., and everything works great...EXCEPT....I have a situation
where I occaisionally want to block outbound traffic from a certain
host inside to a certain destination IP and/or port.  For example, I'd
like to block one host from within my network from using Instant
Messenger but still allow web surfing.  I've been able to dynamically
block ALL outbound access to the internet but I'm unable to restrict
access to certain destination ports.

So this works:
iptables -A INPUT -s 10.1.1.10 -j DROP
iptables -A OUTPUT -d 10.1.1.10 -j DROP
iptables -A FORWARD -d 10.1.1.10 -j DROP

And I thought I could do something like this:
iptables -A OUTPUT -s 10.1.1.10 -p tcp -m tcp --dport 5190 -j DROP
iptables -A FORWARD -d 10.1.1.10 -p tcp -m tcp --dport 5190 -j DROP
....but it has no effect.

I've tried different combinations of "-d and -s" and "--dport and
--sport" just to see if I was doing something backwards....no dice.  I
was wondering if I needed to set up some kind of pre or post routing
because of the masquerading?

Any help would be appreciated.

Thanks!

-- 

Jerry A.

Re: Block outbound host to specific port using Masq./NAT?

[Gavin Hamill]

On Monday 03 January 2005 21:45, Jerry A. Applebaum wrote:

> And I thought I could do something like this:
> iptables -A OUTPUT -s 10.1.1.10 -p tcp -m tcp --dport 5190 -j DROP
> iptables -A FORWARD -d 10.1.1.10 -p tcp -m tcp --dport 5190 -j DROP
> ....but it has no effect.

You almost got it :)

Try

iptables -A FORWARD -s 10.1.1.10 -p tcp -m tcp --dport 5190 -j DROP

because the OUTPUT chain only refers to connections originating from the 
firewall machine, although I can see how this is confusing since it's the 
firewall machine doing the MASQ :)

Also, I would not be at all surprised if ICQ/AIM also tries to contact 
login.icq.com on port 80 if 5190 fails, in the same way that MSN Messenger 
does

Cheers,
Gavin.