Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:

iptables -A OUTPUT -s 10.7.53.2 -d 10.7.53.5 -j REJECT

We know how to block ports coming in and going out as well as ip addresses. However, we are unsure as to what the line above does.

At first we thought it blocks output from one ip address to another, but when we tested this theory we found the assumption was invalid.

share|improve this question
    
Could you explain what mean it was untrue. –  F. Hauri Nov 11 '12 at 15:24
    
what we thought the line was meant to do was not right –  Hashey100 Nov 11 '12 at 15:29
    
This may be better suited for Super User or Server Fault. –  Iszi Nov 11 '12 at 22:25
add comment

1 Answer

up vote 4 down vote accepted

As I understand:

Switch -d and -s are associated by a and expression.

But.

As you're talking about a firewall, and iptables -A OUTPUT mean iptables -t filter -A OUTPUT, this seem not to be right:

chains INPUT and OUTPUT concern packet from or to the host (firewall).

This coud be usefull if your firewall hold many different IP address and want to make condition based on wich IP is used.

Even if 10.7.53.2 is the only (local) IP of your firewall, -s switch is clearly useless.

For blocking a traversing connexion, you have to instruct FORWARD chain.

iptables -A FORWARD -s 10.7.53.2 -d 10.7.53.5 -j REJECT

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.