Confusion about interfaces, iptables, connections, local connection

Question

I configured my iptables today and ran into some questions i could not resolve yet. So it would be nice, if someone could verify or answer the following to clarify:

1. Each interface can be configured for ipv4 or/and ipv6 seperately. iptables rules like iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT apply to all interfaces (only on ipv4)?
2. A single connection (as e.g. shown by netstat -na) always uses only one interface?
3. The interface is automatically chosen by the ip address. E.g when having something like

   *:~$ ip addr
   1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default
   link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   inet 127.0.0.1/8 scope host lo
      valid_lft forever preferred_lft forever
   2: eth0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
   link/ether * brd ff:ff:ff:ff:ff:ff
   inet 128.176.123.45 brd * scope global eth0
      valid_lft forever preferred_lft forever
   

   all IPs from 127.0.0.1 to 127.255.255.255 will go by interface lo, the **rest by eth0 (if there is routing possible; can be see by netstat -r)?

4. Situation: A server and client (for some software) run at the same computer and they communicate with each other. So the maschine communicates with itself. The server listens on some Port. We can use netstat -na to see the connections, e.g. a connection: Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 128.176.123.45:60471 128.176.123.45:50010 ESTABLISHED

   What is the difference between the addresses beeing: the external ip (like now), the local network ip (like 192.168.1.4), 127.0.0.1? Is eth0 used for the first two and lo only for the last one?

   1. Is communicating to 127.0.0.1 only reachable from that maschine itself?
   2. Is communicating to 192.168.1.4 only possible from the maschine itself and the LAN?
   3. Is communicating to 128.176.123.45 only possible from the maschine itself, LAN and internet/GAN?
   4. Is the eth0 interface always used except in the 127.0.0.1 case (so communicating with 128.176.123.45 in order to speak with the machine itself uses eth0 as well)?
5. 0.0.0.0 is a wildcard when binding a port, that all named options can connect to that port? It is accepting connections from all interfaces and gets a concrete local address for every built connection?
6. When I block every Port except the lo interface with (not having other rules) like this:

   iptables -P INPUT DROP
   iptables -P OUTPUT DROP
   iptables -P FORWARD DROP
   iptables -A INPUT -i lo -j ACCEPT
   iptables -A OUTPUT -o lo -j ACCEPT 

   I can ping to 192.168.1.4 to the maschine itself, but i definitly configured this only to the eth0 interface?

Answer 1

1. Yes, that rule does not have an interface specifier, so applies to all interfaces (unless there was some other rule like -i lo -j RETURN above it).

2. No, if you are doing traffic routing, what interface a connection is using could change dynamically. (Strictly speaking, it might still be bound to a specific interface because that's where the address is, but the kernel might be sending the traffic out a different interface depending on routing table).

3. Source address is the most common selector, but not the only one. You need to consider the Routing Policy database (RPDB) ip rule, as it can contain much more complex rules than simply source address, including multiple routing tables.

   3.a. Every modern linux system actually has at least 3 routing tables, start with ip rule; it will generally contain from all lookup $X, where $X is local, main, default.

   3.b. ip route show table local should show you all routes with a scope of link or host. You'll see all of your local IPs in here.

   3.c. ip route show table main this is the normal routing table you see

4. If the destination address is local to the machine (See the local routing table), the kernel will actually realize this via the table, and send it over the loopback interface, and NOT eth0.

   4.1. Yes

   4.2. Depends on routing in the network, if there is DNAT or other routes, then it could be accessible further than just the LAN.

   4.3. You say local+LAN+WAN, what else is there besides this?

5. 0.0.0.0 is known as INADDR_ANY, and wildcard binds all IPs on the host to that address.

6. See what I wrote above, if the address is local, it goes via loopback per the routing table, and NOT via eth0.