UNIX for Dummies Questions & Answers

I want to limit all *outbound* traffic on eth0 (or all *.*) on port 25 to a specific (allowed) range...

I.E.
192.168.1.5 (local ip) tries to connect to 1.2.3.4:25 (outside real world ip)

It can proceed because 1.2.3.0/24 is the allowed range

Now, 192.168.1.5 (local ip) tries to connect to 2.3.4.5:25 it is not allowed (drop?) because 2.3.4.5 is not part of the 1.2.3.0/24

Thanks for the help I could not find a way to do this:

This did not work:
iptables -A OUTPUT -o eth0 -p tcp -d 1.2.3.0/24 --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT


Thanks!

You just need to do the drop on all other port 25 outbound, also the NEW,ESTABLISHED thing doesn't really help you here as you want all types to work.

Code:

iptables -A OUTPUT -o eth0 -p tcp -d 1.2.3.0/24 --dport 25 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 25 -j DROP

I'd also suggest you leave off the -o eth0 too as you are trying to prevent outbound traffic in general, regardless of it's routing.

edit: According to the iptables help, you can actually specify negation - ie:

Code:

iptables -A OUTPUT -p tcp \! -d 1.2.3.0/24 --dport 25 -j DROP

Never tried this myself though so YMMV