Question: Iptables -- 127.0.0.1

External Since: Nov 04, 2005 Posts: 99

I have a little confusion with this.

I hear about this "sanity check" for packets that may have
a spoofed source address (or destination) of 127.0.0.1

Every single reference, tutorial, sample iptables scripts,
etc. that I've seen, they address the issue referring to
127.0.0.1 as the loopback address. Example:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -j DROP
iptables -A INPUT -d 127.0.0.1 -j DROP

That way, if the packet legitimately is from the host to
itself, then it will match the first rule and pass; if
a packet did not pass the first rule, then it can not
possibly have source or destination IP of 127.0.0.1, and
thus it is dropped, guilty of being a fake packet.

What was recently brought to my attention is: shouldn't
that be 127.0.0.0/255.0.0.0 ?? That is, shouldn't the
entire range 127.*.*.* be considered? I'm not sure the
claim has merit, but it made me wonder -- I always
thought 127.0.0.1 is *the one* special IP address for
the loopback interface; but I'm told that the entire
range 127.*.*.* has the same effect? Can someone
clarify this?

If the claim is true, then why aren't all the examples
and tutorials on iptables out there using the 127.0.0.0/8
subnet?

Thanks,

Carlos
--

External Since: May 10, 2006 Posts: 15

You are correct, Carlos.

The entire Class A Non-Routable address range should be evaluated
against. The reason that in most example scripts that 127.0.0.1 is
utilized is due to the fact that it is common practice to allocate this
address to the loopback function.

It is entirely conceivable that a person could alter this address to
utilize any address within the Class A Non-Routable address range. Thus
you should first verify that your loopback interface is in fact
assigned the ip address that you expect. And that the route assigned to
the loopback interface is the Class A Non-Routable address range.

Thomas