Iptables outbound block denies inbound

Question

I'm trying to block only outbound connections to specific IP addresses, however I want to allow inbound connections from the same IP addresses.

From what I understand about blocking outbound connections, they shouldn't block if an inbound connection has been made successfully.

I basically set up rules like this:

--append OUTPUT --jump DROP --destination x.x.x.x

And to allow established connections:

--append INPUT --in-interface eth0 --match state --state RELATED,ESTABLISHED --jump ACCEPT

I want connections to be allowed when this IP address attempts to connect to the server, but when my server tries to make an outbound connection, it shouldn't be able to make it.

I would like to block complete access for the server to make outbound connections to x.x.x.x. However when a user from that IP wishes to access the server they should be able to visit sites on certain ports.

Answer 1

You are nearly there with your attempted firewall rules. Here's what you need to allow inbound traffic from host 10.10.10.10 while stopping outbound traffic to that address:

1. Allow inbound (presumably to any port)
2. Allow outbound replies to established inbound connections
3. Block remaining outbound traffic

So,

iptables -A INPUT --src 10.10.10.10 --jump ACCEPT

iptables -A OUTPUT --match state --state RELATED,ESTABLISHED --jump ACCEPT
iptables -A OUTPUT --dst 10.10.10.10 --jump DROP

You don't really need the INPUT rule unless you have later rules reaching DENY/REJECT or your policy is set that way.

Answer 2

You are getting it wrong! Here is what i understand:

First of all, look at your input rule. It shall allow input by state, but what does state mean? It means, that traffic has gone out from your server to this address, before! So this rule will never match, if you block output (for this address) completely.

This is why your complete endeavor is not possible, state is only available in input.

There might be some hacky solution. But with the given options it is not possible.

PS

After your question i checked for an old topic again and guess what. After reading your post again, it stroke me, that this is EXACTLY what you want. Look at PortKnocking.

It adds a component to your request, which makes it even better; randomness.

Just configure a knocking scheme and not only allow output connections, but also input only if the correct knocking has happened, then.