Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following rules in my iptables (I cut out the rules that aren't relevant to this question):

*raw
:PREROUTING ACCEPT
:OUTPUT ACCEPT
-A PREROUTING -i lo -j NOTRACK 
-A OUTPUT -o lo -j NOTRACK 
COMMIT

*filter
-A INPUT -i lo -j ACCEPT 
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -j ACCEPT 
COMMIT

I've put this into place because I had overflows on ip_conntrack due to interacting with a server locally over the loopback. Is there any security issues I'm missing here?

share|improve this question
    
should I also add <code>-A OUTPUT -i lo -j NOTRACK</code>? –  Tim Tisdall Sep 10 '12 at 20:55

1 Answer 1

up vote 1 down vote accepted

I'd say no. lo is not accessible from outside, so if an attacker has gotten to a point where he could attack that interface, you already have bigger problems to worry about.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.