Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to restrict outbound traffic to only localhost using iptables. I already have a default DROP policy on OUTPUT and a rule REJECTing all traffic. I need to add a rule above that in the OUTPUT chain.

I have seen a couple different examples for this type of rule, the most common being:



-A OUTPUT -o lo -s -d -j ACCEPT

Is there any reason to use the latter rather than the former? Can packets on lo have an address other than

share|improve this question
up vote 2 down vote accepted

If your machine has multiple interfaces, and you try to communicate with the IP on one of these other interfaces, the traffic will actually go over the lo interface. Linux is smart enough to figure out this traffic is destined for itself, and not try to use the real interface.

The rule -A OUTPUT -o lo -j ACCEPT will allow this other traffic, while the rule -A OUTPUT -o lo -s -d -j ACCEPT would reject it.


You can see everything the kernel will route over the loopback interface by running

ip route show type local table all

(just note the first value, which is either an IP or a network/mask)

share|improve this answer

Yes it can have other addresses. You can possibly see anything from in-use. On Debian/Ubuntu system addresses in the range are used to deal with an Apache issue.

Other addresses can also be assigned, but this is very rare.

share|improve this answer

I already have a default DROP policy on OUTPUT and a rule REJECTing all traffic

That makes no sense; they achieve the same end. The default policy to DROP is sufficient.

The rule you're looking for is probably

iptables -A OUTPUT -o lo -j ACCEPT

But some more experience with iptables will (hopefully) teach you not to do that; use input rules instead.

share|improve this answer
In this case since I'd prefer for the blocked outbound traffic to be REJECTed and not DROPped and since REJECT is not a valid default policy I have that rule. In any case, that part isn't relevant to my question regarding localhost. – Dave Forgac Mar 22 '12 at 17:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.