Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've setup my raring-ringtail machine and decided to use iptables after removing ufw to have more control over my network security. However, I'm stuck at one point. First, I've set default policy to deny all traffic by default:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

After that, I've added ACCEPT rules for my local network interfaces, which work fine. However, in order for some of my local services (such as web-server local browsing) to work, I need to allow traffic originating to/from my local interface (lo). For this, I've found two versions on the net:

[1]

iptables -A INPUT -i lo -j ACCEPT # Allow local addresses
iptables -A OUTPUT -o lo -j ACCEPT # Allow local addresses

[2]

iptables -A INPUT -s 127.0.0.1 -j ACCEPT # Allow Allow local addresses
iptables -A OUTPUT -d 127.0.0.1 -j ACCEPT # Allow Allow local addresses

I want to know whats the difference between the two? Is allowing traffic to/from the "lo" interface same as originating/destined-to 127.0.0.1? Which one should I use and why?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Use interface lo.

1) Ubuntu/Debian weirdly use 127.0.1.1 instead of 127.0.0.1 to resolve your canonical hostname.

2) By default, 127.0.0.0/8 (127.anything) goes to the loopback. You shouldn't narrow your filters to only one of the addresses in that subnet.

steven@lat:~$ ping 127.254.254.254 -c 1
PING 127.254.254.254 (127.254.254.254) 56(84) bytes of data.
64 bytes from 127.254.254.254: icmp_req=1 ttl=64 time=0.052 ms

--- 127.254.254.254 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.052/0.052/0.052/0.000 ms
steven@lat:~$

3) You can assign any other addresses you like to the loopback adapter.

Whatever you do, iptables -A INPUT -i lo -o lo -j ACCEPT is not a bad idea. It says packets from this machine to this machine are acceptable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.