0

I have the following iptables rules:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s MY_IP_ADDRESS/32 -p tcp -m tcp --dport 6379 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -i lo -p tcp -m tcp --dport 6379 -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT

As you can see, I can ssh into my server from everywhere, and I can access my redis db from my local IP (MY_IP_ADDRESS) and localhost.

From my computer itself, redis-cli -h xx.xx.xx.xx -p 6379 works. But on the server itself, I cannot connect to the redis db from redis-cli.

When I delete the following iptables rule, it works again:

-A INPUT -j DROP

How can I allow localhost connections to my redis server?

1 Answer 1

0

You can add one rule per port:

-A INPUT -i lo -p tcp --dport some-port -j ACCEPT
-A INPUT -i lo -p tcp --dport another-port -j ACCEPT

or add a generic one for all traffic from localhost:

-A INPUT -i lo -j ACCEPT

As a side note, you can get rid of -A INPUT DROP as the last rule for INPUT if you set DROP as a policy: -P INPUT DROP

Update: as another side note, actually, if you have -P OUTPUT ACCEPT, then there is no need to add any ACCEPT rules for OUTPUT (you might add rules for DROP, for example, but no need for ACCEPT because that is what will end up happening with any traffic that goes through OUTPUT that is not matching any rule).

3
  • Thank you for your answer. How can I set one rule for localhost + my_external_ip? I tried -A INPUT -s MY_IP/32,127.0.0.1 -p tcp --dport 6379 -j ACCEPT but this does not work either.
    – Sam Leurs
    Commented Sep 29, 2021 at 15:35
  • But wait.... this is source address in INPUT, right? I do not see why you would consider trying to figure that out by the source address if it is local traffic (in INPUT you should not expect to see a lot of traffic that has your ip address in the source). Use the input device with -i lo(because even if you try to establish a connection using the IP address of one of your interfaces, traffic won't hit the network interface, it will move around through lo).
    – eftshift0
    Commented Sep 29, 2021 at 16:34
  • Just in case, and assuming you want to do it regardless, it should not fail to add the rule the way you have it there (I see no point in having the netmask /32, just in case), but in man iptables on my debian testing, it says that if you provide multiple addresses/netmasks in -s, multiple rules will be added in the end so expect to get 2 separate rules after running that command instead of just one rule.
    – eftshift0
    Commented Sep 29, 2021 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .