I configured my iptables today and ran into some questions i could not resolve yet. So it would be nice, if someone could verify or answer the following to clarify:
- Each interface can be configured for ipv4 or/and ipv6 seperately. iptables rules like
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPTapply to all interfaces (only on ipv4)?
- A single connection (as e.g. shown by
netstat -na) always uses only one interface?
- The interface is automatically chosen by the ip address. E.g when having something like
*:~$ ip addr 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether * brd ff:ff:ff:ff:ff:ff inet 184.108.40.206 brd * scope global eth0 valid_lft forever preferred_lft foreverall IPs from
127.255.255.255will go by interface lo, the **rest by eth0 (if there is routing possible; can be see by
Situation: A server and client (for some software) run at the same computer and they communicate with each other. So the maschine communicates with itself. The server listens on some Port. We can use
netstat -nato see the connections, e.g. a connection:
Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 220.127.116.11:60471 18.104.22.168:50010 ESTABLISHED
What is the difference between the addresses beeing: the external ip (like now), the local network ip (like 192.168.1.4), 127.0.0.1? Is eth0 used for the first two and lo only for the last one?
- Is communicating to 127.0.0.1 only reachable from that maschine itself?
- Is communicating to 192.168.1.4 only possible from the maschine itself and the LAN?
- Is communicating to 22.214.171.124 only possible from the maschine itself, LAN and internet/GAN?
- Is the eth0 interface always used except in the 127.0.0.1 case (so communicating with 126.96.36.199 in order to speak with the machine itself uses eth0 as well)?
- 0.0.0.0 is a wildcard when binding a port, that all named options can connect to that port? It is accepting connections from all interfaces and gets a concrete local address for every built connection?
- When I block every Port except the lo interface with (not having other rules) like this:
iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPTI can ping to 192.168.1.4 to the maschine itself, but i definitly configured this only to the eth0 interface?