Why can’t I block https?

Question

May I ask why can I not block all https traffic in iptables?

I tried:

OUTPUT --dport 443 -j DROP

And even:

OUTPUT --sport 443 -j DROP

None of this works. Https webpages are still perfectly accessible. WHY? What kind of PEBKAC have I managed to subject myself to this time?

Answer 1

Try this

You can block access to all https based sites with iptables using the following rule:

iptables -t nat -I PREROUTING -m tcp -p tcp --dport 443 -j DROP

To block particular sites use the -d option to specify the hostname.

iptables -t nat -I PREROUTING -m tcp -p tcp -d www.example.com --dport 443 -j DROP

Try this

iptables -A OUTPUT -p tcp --dport 443 -j DROP

Answer 2

Finally. Yep, it was a PEBKAC.

The solution is to write: iptables -I OUTPUT -p tcp --dport 443 -j DROP

The way I was doing it, I was getting error: unknown option "--dports"

I didn’t see it, because I wasn’t adding the rule with the iptables command, but rather by adding it to a file that was being read by iptables at startup. Silly me.