2.5. Blocking Outgoing Traffic
Problem
Drop all outgoing network traffic. If possible, do not affect incoming traffic.
Solution
For
iptables
:
# iptables -F OUTPUT # iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT # iptables -A OUTPUT -j REJECT
For ipchains :
# ipchains -F output # ipchains -A output -p tcp ! --syn -j ACCEPT # ipchains -A output -j REJECT
Depending on your shell, you might need to escape the exclamation point.
Discussion
This recipe takes advantage of iptables’s statefulness. iptables can tell the difference between outgoing traffic initiated from the local machine and outgoing traffic in response to established incoming connections. The latter is permitted, but the former is not.
ipchains is stateless but can recognize (and reject) packets with the SYN bit set and the ACK and FIN bits cleared, thereby permitting established and incoming TCP connections to function. However, this technique is insufficient for UDP exchanges: you really need a stateful firewall for that.
See Also
iptables(8), ipchains(8).
Get Linux Security Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.