Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone here use iptables with skype? The only way I have been able to get it working so far is to allow all the high ports- something like

iptables -A OUTPUT -p UDP --dport 1024:65535 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p UDP --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p tcp --dport 1024:65535 -j ACCEPT

which is obviously less than ideal. The problem is as far as I can tell the ports skype uses are somewhat random. I was hoping it might be possible to allow application level firewalling by using setuid or setguid, for example

sudo addgroup skypeGrp
sudo usermod theUser -G skypeGrp
sudo chgrp skypeGrp /usr/bin/skype
chmod g+s /usr/bin/skype
iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT 

but this didn't seem to work.

Perhaps other have a better solution?

share|improve this question
up vote 3 down vote accepted

Set it up to allow all outbound. And then allow related/established as one of the first rules.

Something like:

# Accept loopback & established/related connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop invalid on tcp
iptables -A INPUT -p tcp -m conntrack --ctstate INVALID -j DROP

# Set default DROP policy
iptables -P INPUT DROP
iptables -P FORWARD DROP

# But allow everything out

# Now set what you want to allow in.

# e.g. SSH in
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
share|improve this answer
Doesn't Skype need an inbound port though? or does th -m conntrack somehow take care of that?Also what is the -A always chain, I have never come across that one. – fpghost Mar 14 '13 at 21:45
Connection tracking will take care of related/established connections so they won't get dropped. Try it out. Sorry about the always chain... it was copied & modified from some rules I have. – Matt H Mar 14 '13 at 22:25
Thanks for the reply. So just checking I understand: is this basic idea that skype will first connect on some outbound port (which we have allowed), say port 38768 then once this connection is established -m conntrack will allow skype to form related inbound connections too on say 15672? – fpghost Mar 14 '13 at 22:46
Yes, that's correct – Matt H Mar 14 '13 at 23:22
By the way, this is for an individual machine. If this is for a router, then you'll be dealing with the FORWARD chain too. As INPUT chain only deals with data destined to the machine (not through). – Matt H Mar 14 '13 at 23:24

In my experience if you allow all outgoing trafic you can make calls but you cant receive calls from others unless you open a port for incoming connections.

In Skype Go to

Skype > Options > Advanced > Connections

You can decide what port skype uses. It was 7004 by default.

I think you need to allow both tcp and udp.

iptables -A INPUT -p tcp --dport 7004 -j ACCEPT
iptables -A INPUT -p udp --dport 7004 -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.