I'm learning how to use iptables
and I'm writing a very simple firewall on Ubuntu.
Using just the filter table, I added the following rules
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
as I want to let pass just the packets I desire.
Then I tried to add rules to make simple HTTP connections, and so, for a very first attempt, I added
iptables -A INPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
the first line to accept all TCP traffic and the second to accept DNS answers.
Similarly, for the OUTPUT chain, I added
iptables -A OUTPUT -p tcp -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
But when I try to use lynx
the connection doesn't take place.
I think the only problems is the DNS, since all the TCP traffic is accepted. But packets to/from port 53 can pass through the firewall ... so, where the problem is?
I added the following two rules and now it works.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
and using Wireshark I realized that DNS requests are also to/from loopback interface. I never imagined that ... why?