Simple question

Simple question

[Oriol Magrané]

[-- Attachment #1: Type: text/plain, Size: 341 bytes --]


    Hello!
    Just one question...
    I have a firewall with the INPUT, OUTPUT and FORWARD policies set to DROP, and now I want to allow connections from localhost to localhost (any port). Which chains are implied here? INPUT? OUTPUT? Both?
    How should the needed rule(s) be?

    Thank you very much in advance!

    Oriol


[-- Attachment #2: Type: text/html, Size: 1226 bytes --]

Re: Simple question

[Aleksandar Milivojevic]

Oriol Magrané wrote:
>  
>     Hello!
>     Just one question...
>     I have a firewall with the INPUT, OUTPUT and FORWARD policies set to 
> DROP, and now I want to allow connections from localhost to localhost 
> (any port). Which chains are implied here? INPUT? OUTPUT? Both?
>     How should the needed rule(s) be?

You'd need both INPUT and OUTPUT.  Just as if it was connection to 
remote system (just think what rules you would put on both local and 
remote system if it was remote connection, and than apply both sets of 
rules to local system, removing duplicates).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: Simple question

[Antony Stone]

On Wednesday 05 May 2004 4:27 pm, Oriol Magrané wrote:

>     Hello!
>     Just one question...
>     I have a firewall with the INPUT, OUTPUT and FORWARD policies set to
> DROP, and now I want to allow connections from localhost to localhost (any
> port). Which chains are implied here? INPUT? OUTPUT? Both? How should the
> needed rule(s) be?

Yes, you need to allow the packets out through OUTPUT, in through INPUT, and 
the interfaces will both be lo.

If in doubt, just add some LOGging rules and see what happens when you try to 
send packets.

Regards,

Antony.

-- 
Late in 1972 President Richard Nixon announced that the rate of increase of 
inflation was decreasing.   This was the first time a sitting president used 
a third derivative to advance his case for re-election.

 - Hugo Rossi, Notices of the American Mathematical Society

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Simple question (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2004.05.05 11:27, Oriol Magrané  - omagrane@mediapro.es  
wrote:
> 
>     Hello!
>     Just one question...
>     I have a firewall with the INPUT, OUTPUT and FORWARD
> policies set to DROP, and now I want to allow connections
> from localhost to localhost (any port). Which chains are
> implied here? INPUT? OUTPUT? Both?
>     How should the needed rule(s) be?
> 
>     Thank you very much in advance!
> 
>     Oriol
> 
>
I put these simple rules in my INPUT and OUTPUT chains.
I checked the counts, and these handle the most traffic,
so I put them first in their chains.

# accept packets originating on this machine
iptables -A INPUT -i lo -j ACCEPT

# allow packets from this machine to this machine
iptables -A INPUT -o lo -j ACCEPT

I hope that helps.

Jim

Re: Simple question

[Martijn Lievaart]

Oriol Magrané wrote:

>
>     Hello!
>     Just one question...
>     I have a firewall with the INPUT, OUTPUT and FORWARD policies set
> to DROP, and now I want to allow connections from localhost to
> localhost (any port). Which chains are implied here? INPUT? OUTPUT? Both?
>     How should the needed rule(s) be?
>


This should do it:
-A INPUT -i lo -j ACCEPT
-A OUTPUT -i lo -j ACCEPT

HTH,
M4

Re: Simple question

[Antony Stone]

On Wednesday 05 May 2004 6:43 pm, Martijn Lievaart wrote:

> Oriol Magrané wrote:
> >     Hello!
> >     Just one question...
> >     I have a firewall with the INPUT, OUTPUT and FORWARD policies set
> > to DROP, and now I want to allow connections from localhost to
> > localhost (any port). Which chains are implied here? INPUT? OUTPUT? Both?
> >     How should the needed rule(s) be?
>
> This should do it:
> -A INPUT -i lo -j ACCEPT
> -A OUTPUT -i lo -j ACCEPT

Actually, I would suggest instead:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

:)

Antony.

-- 
"When you talk about Linux versus Windows, you're talking about which 
operating system is the best value for money and fit for purpose. That's a 
very basic decision customers can make if they have the information available 
to them. Quite frankly if we lose to Linux because our customers say it's 
better value for money, tough luck for us."

 - Steve Vamos, MD of Microsoft Australia

                                                     Please reply to the list;
                                                           please don't CC me.