IPTables - possible to block all traffic destined for ports that use UDP?

[Swiftslide]

i.e. not just block UDP packets, but any packets that go to any port that uses UDP? I realise I could get a list of the ports and simply block each of them ports individually, but I was wondering if there's a quicker/more elegant way?

[Irithori]

iptables -A INPUT -p udp -j DROP

That will drop any udp packets, that reach (INPUT) your machine.
So it does what you ask.

[Swiftslide]

iptables -A INPUT -p udp -j DROP

That will drop any udp packets, that reach (INPUT) your machine.
So it does what you ask.

I'm new at this, so correct me if I'm wrong, but my understanding is that the above will drop all UDP packets coming into my machine. What I need to do is drop all packets, of any protocol, that are addressed to any port that USES UDP. For example, port 22 (SSH) uses UDP packets, so I need to block ALL packets with --dport 22, even TCP packets. Similarly for all ports that accept UDP.

[Irithori]

No, ssh uses tcp only.

tcp and udp are on the same layer, the transport layer to be precise.
Difference between them: udp is stateless, tcp stateful

Have a look here
TCP/IP model - Wikipedia, the free encyclopedia

Also, iptables works like a filter.
The more arguments you give, the finer it acts


This will drop *ALL* incoming udp traffic

iptables -A INPUT -p udp -j DROP

This will drop all udp traffic coming from 192.168.1.1

iptables -A INPUT -p udp -s 192.168.1.1 -j DROP

This will drop all udp traffic coming from 192.168.1.1 to port 123 of *your* machine. (--dport = destination port)
udp 123 happens to be the ntp protocoll´s default port , so in plain text this rule would forbid connections from 192.168.1.1 to the ntp server of your machine.

iptables -A INPUT -p udp -s 192.168.1.1 --dport 123 -j DROP

You are new to this, so beware of locking yourself out.
Happens to anyone playing with firewalls

I would suggest, first read about the TCP/IP Model
and with that knowledge read about iptables here
netfilter/iptables project homepage - Documentation about the netfilter/iptables project