How can I block all traffic to port 110 to and IP using IPtables?

abefroman · 11-08-2005, 12:27 PM

How can I block all traffic to port 110 to and IP using IPtables?

I have:
iptables -t nat -A PREROUTING -i eth1 -d 10.10.0.254:110 -j DROP

which didnt work, I also tried

iptables -t nat -A PREROUTING -i eth1 -d 10.10.0.254 --destination-port 110 -j DROP
and
iptables -t nat -A PREROUTING -i eth1 -d 10.10.0.254 -p 110 -j DROP
these didnt work either.

Thanks in advance

Matir · 11-08-2005, 01:09 PM

Don't use the NAT table for filtering.

Code:

iptables -A FORWARD -i eth1 -d 10.10.0.254 -p tcp --dport 110 -j DROP

ppuru · 11-08-2005, 01:15 PM

You can also use tcpwrappers to do the same -

Add the pop3 service to hosts.deny

abefroman · 11-08-2005, 02:05 PM

Quote:

Originally posted by Matir
Don't use the NAT table for filtering.

Thanks! Why shouldnt the nat be used for filtering?

Matir · 11-09-2005, 06:43 AM

Quote:

Originally posted by ppuru
You can also use tcpwrappers to do the same -

Add the pop3 service to hosts.deny

That only works if someone is making connections to your pop3 server, not a remote one through your machine.

Matir · 11-09-2005, 06:45 AM

Quote:

Originally posted by abefroman
Thanks! Why shouldnt the nat be used for filtering?

Mainly because that's not what it's intended for. Some of the matches and targets aren't available there. Additionally, it IS intended to do port forwarding, NAT, etc. The default table is the filter table, which is intended to handle filtering of this sort.

abefroman · 11-09-2005, 01:13 PM

i added
iptables -A FORWARD -i eth1 -d 10.10.0.254 -p tcp --dport 110 -j DROP

but email still goes through to 10.10.0.254, it should all be blocked though, no?

Matir · 11-10-2005, 06:41 AM

No... that would block POP3 connections to 10.10.0.254. If you are sending email, you need to look at SMTP.

ppuru · 11-16-2005, 07:26 PM

Where is the traffic coming in from? eth1 or eth0?