Question

I have a server in my network for which I want to DROP outbound traffic to any other host in the LAN, except for one or 2 single hosts. E.g. I want to block outbound traffic to 123.123.1.1/16, except for 123.123.10.10 and 123.123.20.20. How can I do this in IPTABLES?

I have tried something like this:

sudo iptables -D OUTPUT -d 123.123.1.1/16 ! -d 123.123.10.10 -j DROP

However I get an error that the -d operator can only be used once.

Answer 1

Do an ACCEPT before the DROP.

iptables -A OUTPUT -d 123.123.10.10 -j ACCEPT
iptables -A OUTPUT -d 123.123.1.1/16 -j DROP

That way once the packet matches the first rule it won’t even be tested against the second.