Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've setup my raring-ringtail machine and decided to use iptables after removing ufw to have more control over my network security. However, I'm stuck at one point. First, I've set default policy to deny all traffic by default:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

After that, I've added ACCEPT rules for my local network interfaces, which work fine. However, in order for some of my local services (such as web-server local browsing) to work, I need to allow traffic originating to/from my local interface (lo). For this, I've found two versions on the net:


iptables -A INPUT -i lo -j ACCEPT # Allow local addresses
iptables -A OUTPUT -o lo -j ACCEPT # Allow local addresses


iptables -A INPUT -s -j ACCEPT # Allow Allow local addresses
iptables -A OUTPUT -d -j ACCEPT # Allow Allow local addresses

I want to know whats the difference between the two? Is allowing traffic to/from the "lo" interface same as originating/destined-to Which one should I use and why?

share|improve this question
up vote 1 down vote accepted

Use interface lo.

1) Ubuntu/Debian weirdly use instead of to resolve your canonical hostname.

2) By default, (127.anything) goes to the loopback. You shouldn't narrow your filters to only one of the addresses in that subnet.

steven@lat:~$ ping -c 1
PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=64 time=0.052 ms

--- ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.052/0.052/0.052/0.000 ms

3) You can assign any other addresses you like to the loopback adapter.

Whatever you do, iptables -A INPUT -i lo -o lo -j ACCEPT is not a bad idea. It says packets from this machine to this machine are acceptable.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.