I am using fwbuilder and have tried setting up rules that both allow lo
interface and source ip 127.0.0.1
, as follows:
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT
...
$IPTABLES -A INPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
The connection appears to work fine, but then why do I see several of these errors in /var/log/syslog
??
RULE 4 -- DENY IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=43254 DF PROTO=TCP SPT=47654 DPT=4949 WINDOW=256 RES=0x00 ACK PSH FIN URGP=0
UPDATE: output of iptables -L -v
tcpdump
to capture an entire connection with that blocked packet at the end of it. The way it got to a state where the firewall would block that packet might be enlightening.