Enable Loopback confuse

Enable Loopback confuse

[nattapon viroonsri]

Anyone please recommend me about iptables loopback

When i enable loopback i just use 2 line below and everything work fine
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

But i see many example around then have also included this line below  to 
enable loopback
iptables -A FORWARD -o lo - j ACCEPT ?

i try generate packet locally like "telnet localhost 25" and debug with 
"iptables -L -nv"
but dont see any packet match  this rule(FORWARD)    only  INPUT and OUTPUT 
matched

So can i omit this line ?
or what kind of packet that match this rule ?

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/

RE: Enable Loopback confuse

[Joris Dobbelsteen]

Yes, normally loopback traffic is not forwarded

Telnet generates packet
Iptables evaluates OUTPUT filter
Packet it routed, destination is to local system
Iptables evaluates INPUT filter
Someby received the packet

This is how (I guess) it would work...

- Joris

>-----Original Message-----
>From: netfilter-bounces@lists.netfilter.org 
>[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
>nattapon viroonsri
>Sent: vrijdag, 19 augustus 2005 12:42
>To: netfilter@lists.netfilter.org
>Subject: Enable Loopback confuse
>
>
>Anyone please recommend me about iptables loopback
>
>When i enable loopback i just use 2 line below and everything 
>work fine iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT 
>-o lo -j ACCEPT
>
>But i see many example around then have also included this 
>line below  to enable loopback iptables -A FORWARD -o lo - j ACCEPT ?
>
>i try generate packet locally like "telnet localhost 25" and 
>debug with "iptables -L -nv"
>but dont see any packet match  this rule(FORWARD)    only  
>INPUT and OUTPUT 
>matched
>
>So can i omit this line ?
>or what kind of packet that match this rule ?
>
>_________________________________________________________________
>Don't just search. Find. Check out the new MSN Search! 
>http://search.msn.com/
>
>
>
>

Re: Enable Loopback confuse

[/dev/rob0]

On Friday 2005-August-19 05:41, nattapon viroonsri wrote:
> When i enable loopback i just use 2 line below and everything work
> fine iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUTPUT -o lo -j ACCEPT

Correct, unless earlier rules do something to prevent these rules from 
being evaluated.

> But i see many example around then have also included this line
>  below to enable loopback
> iptables -A FORWARD -o lo - j ACCEPT ?

They are wrong. FORWARD rules are checked when *both* the source and 
destination IP's are not local. Normal loopback traffic can never hit 
the FORWARD chain.

> So can i omit this line ?
> or what kind of packet that match this rule ?

Yes. None. It's possibly true that specially-crafted packets and silly 
routing could be employed, but this is not a real-world situation.

filter table            IP address
built-in chains         source          destination
----------------        ------          -----------
INPUT                   n/a             local
OUTPUT                  local           not local
FORWARD                 not local       not local

Each packet is checked against the rules in only one of the built-in 
chains, *except* loopback traffic, which hits OUTPUT going out, and 
then INPUT coming in.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: Enable Loopback confuse

[Joris Dobbelsteen]

>-----Original Message-----
>From: netfilter-bounces@lists.netfilter.org 
>[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of /dev/rob0
>Sent: vrijdag, 19 augustus 2005 15:18
>To: netfilter@lists.netfilter.org
>Subject: Re: Enable Loopback confuse
>
[snip]
>
>filter table            IP address
>built-in chains         source          destination
>----------------        ------          -----------
>INPUT                   *ANY*           local
>OUTPUT                  local           *ANY*
>FORWARD                 not local       not local
>
>Each packet is checked against the rules in only one of the 
>built-in chains, *except* loopback traffic, which hits OUTPUT 
>going out, and then INPUT coming in.
>

Thus your diagram should look like this, as you say below...