5

Can someone explain the following rule for filtering traffic to loopback interface?

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

The way I interpret it:

  1. accept all incoming packets to loopback.

  2. reject all incoming packets from 127.x.x.x.x which are not to loopback.

What are the practical uses for these rules? In the case of 1, does this mean that all packets to loopback do not have to go through additional filtering? Is it possible for an incoming packet to loopback to be from an external source?

4

What the rules mean is exactly what you are describing,

1) all packets accessed from the loopback interface.
2) No packets with the loopback address accepted from other sources.

It does not means per se data coming from the loopback interface has to go through additional filtering; what does it means is that the rule 2) is trying to prevent fake/spoofed packets with the loopback address coming from other interfaces.

  • Ok, but packets that pass rule 1 will not go to rule 2, so does that mean, all packets to loopback interface are accepted without filtering? – Joey Sep 30 '17 at 15:52
  • correct, least in the INPUT queue – Rui F Ribeiro Sep 30 '17 at 15:55
2

The first rule is needed for accepting all traffic that comes to loopback interface (traffic from other host - LAN or internet - comes to real physical NIC)

But! Your rules are not completed. If you have default output policy drop all:

iptables -P OUTPUT DROP

Your loopback interface can accept traffic, but your system cannot send traffic from loopback because output policy does not allow this.

Because of this you need to define output policy:

iptables -P OUTPUT ACCEPT

Or define rule only for loopback interface:

iptables -A OUTPUT -o lo -j ACCEPT

The second rule is needed for dropping packets that comes to NOT loopback interfaces (e.g. from LAN interface or from internet) and that has source address as loopback. This is anti-spoofing protection.

If your host has interfaces that directly connected to internet you can add rules that prevent receiving packets with private source addresses to this interfaces.

Example for 192.168.0.0/16 network:

iptables -A INPUT -s 192.168.0.0/16 -j DROP

Answers for your additional questions:

  1. In article at www.linode.com there is chapter View Your Current iptables Rules. In this chapter says:

This means that all incoming, forwarded and outgoing traffic is allowed. It’s important to limit inbound and forwarded traffic to only what’s necessary.

Ok. By default we allowing all traffic (output, input, forward). But what if your system do not use default rules? What if you was changed default rules and forget this? Because of this is recommended to setting up default rules in each iptables scripts:

iptables -P OUTPUT ACCEPT

According to iptables best practice is recommended to setting up default policy to ACCEPT all and deny (if needed) all traffic in the last rule.

  1. Yes. This is exactly what i said. In script at this article is used default policy to reject all traffic:

# then reject them.

-A INPUT -j REJECT

-A FORWARD -j REJECT

-A OUTPUT -j REJECT

  • Can u please explain the reason for dropping output packets? Isn't output from the server inherently safe? Consider this linode.com/docs/security/firewalls/… The first 2 rules in the ipv4 filter (/tmp/v4) are what prompted me to post this question. The ipV4 iptables rules only declare Input filters, there are no output filters. Why? – Joey Oct 1 '17 at 6:57
  • I just found another example for a vpn server that uses this # Allow all loopback (lo) traffic and reject anything # to localhost that does not originate from lo. -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT -A OUTPUT -o lo -j ACCEPT (under file /tmp/v4) linode.com/docs/networking/vpn/set-up-a-hardened-openvpn-server Exactly as u said. I don't know why there is a need to declare output filters though – Joey Oct 1 '17 at 7:26
  • @Joey see above. I was corrected my answer – Egor Vasilyev Oct 1 '17 at 9:50
  • Ok now I understand. Best practice is <accept rule> <accept rule> ... <accept rule> <reject all> So we specify accept rule loopout output because at bottom we reject everything else? Thank you – Joey Oct 1 '17 at 14:22
  • yes you are right – Egor Vasilyev Oct 1 '17 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.