Posted: Wed Jun 01, 2022 20:11 Post subject: Binding loopback interface to 127.0.0. via IPTables/EBTables
Just out of curiousity and experimentation I decided to create "if loopback interface is not 127.0.0.1, then drop packet" rules and ended up with packets being dropped all the time for OUTPUT on my UniFi Dream Machine. Here are the rules
Code:
iptables -I OUTPUT -o lo ! -d 127.0.0.1/32 -j DROP
iptables -I OUTPUT -o lo ! -s 127.0.0.1/32 -j DROP
This happens even after a full factory reset. Is there something wrong with the rule or rule syntax? Router functions don't appear to be affected at all, but aside from loopback, what else can use that IP address? IFConfig only lists loopback interface for 127.0.0.1.
There are no dropped packets for INPUT:
Code:
iptables -I INPUT -i lo ! -d 127.0.0.1/32 -j DROP
iptables -I INPUT -i lo ! -s 127.0.0.1/32 -j DROP
My rule is supposed to make sure that no interface, except for loopback, can use IP 127.0.0.1. If my syntax is correct, then there shouldn't be dropped packets from loopback. Such dropped packets can only be coming from/to non-loopback interface that uses IP 127.0.0.1, but non-loopback interface for such IP doesn't exist...
Joined: 18 Mar 2014 Posts: 12834 Location: Netherlands
Posted: Thu Jun 02, 2022 15:59 Post subject:
Use tcpdump to see what is going on.
But your device actually answers to more than 127.0.0.1.
Ping 127.0.0.2 and you see that that is answered
For IPv4, the loopback interface is assigned all the IPs in the 127.0.0.0/8 address block. That is, 127.0.0.1 through 127.255.255.254 all represent your computer. For most purposes, though, it is only necessary to use one IP address, and that is 127.0.0.1. This IP has the hostname of localhost mapped to it. _________________ Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399 Install guide R7800/XR500:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614 Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087