I configured my iptables today and ran into some questions i could not resolve yet. So it would be nice, if someone could verify or answer the following to clarify:

  1. Each interface can be configured for ipv4 or/and ipv6 seperately. iptables rules like iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT apply to all interfaces (only on ipv4)?
  2. A single connection (as e.g. shown by netstat -na) always uses only one interface?
  3. The interface is automatically chosen by the ip address. E.g when having something like
    *:~$ ip addr
    1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
    2: eth0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether * brd ff:ff:ff:ff:ff:ff
    inet brd * scope global eth0
       valid_lft forever preferred_lft forever
    all IPs from to will go by interface lo, the **rest by eth0 (if there is routing possible; can be see by netstat -r)?
  4. Situation: A server and client (for some software) run at the same computer and they communicate with each other. So the maschine communicates with itself. The server listens on some Port. We can use netstat -na to see the connections, e.g. a connection: Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ESTABLISHED

    What is the difference between the addresses beeing: the external ip (like now), the local network ip (like, Is eth0 used for the first two and lo only for the last one?

    1. Is communicating to only reachable from that maschine itself?
    2. Is communicating to only possible from the maschine itself and the LAN?
    3. Is communicating to only possible from the maschine itself, LAN and internet/GAN?
    4. Is the eth0 interface always used except in the case (so communicating with in order to speak with the machine itself uses eth0 as well)?
  5. is a wildcard when binding a port, that all named options can connect to that port? It is accepting connections from all interfaces and gets a concrete local address for every built connection?
  6. When I block every Port except the lo interface with (not having other rules) like this:
    iptables -P INPUT DROP
    iptables -P OUTPUT DROP
    iptables -P FORWARD DROP
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT 
    I can ping to to the maschine itself, but i definitly configured this only to the eth0 interface?

1 Answer 1

  1. Yes, that rule does not have an interface specifier, so applies to all interfaces (unless there was some other rule like -i lo -j RETURN above it).

  2. No, if you are doing traffic routing, what interface a connection is using could change dynamically. (Strictly speaking, it might still be bound to a specific interface because that's where the address is, but the kernel might be sending the traffic out a different interface depending on routing table).

  3. Source address is the most common selector, but not the only one. You need to consider the Routing Policy database (RPDB) ip rule, as it can contain much more complex rules than simply source address, including multiple routing tables.

    3.a. Every modern linux system actually has at least 3 routing tables, start with ip rule; it will generally contain from all lookup $X, where $X is local, main, default.

    3.b. ip route show table local should show you all routes with a scope of link or host. You'll see all of your local IPs in here.

    3.c. ip route show table main this is the normal routing table you see

  4. If the destination address is local to the machine (See the local routing table), the kernel will actually realize this via the table, and send it over the loopback interface, and NOT eth0.

    4.1. Yes

    4.2. Depends on routing in the network, if there is DNAT or other routes, then it could be accessible further than just the LAN.

    4.3. You say local+LAN+WAN, what else is there besides this?

  5. is known as INADDR_ANY, and wildcard binds all IPs on the host to that address.

  6. See what I wrote above, if the address is local, it goes via loopback per the routing table, and NOT via eth0.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .