Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using fwbuilder and have tried setting up rules that both allow lo interface and source ip, as follows:

$IPTABLES -A INPUT -i lo   -m state --state NEW  -j ACCEPT
$IPTABLES -A OUTPUT -o lo   -m state --state NEW  -j ACCEPT


$IPTABLES -A INPUT  -s   -m state --state NEW  -j ACCEPT
$IPTABLES -A OUTPUT  -s   -m state --state NEW  -j ACCEPT

The connection appears to work fine, but then why do I see several of these errors in /var/log/syslog ??

RULE 4 -- DENY IN= OUT=lo SRC= DST= LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=43254 DF PROTO=TCP SPT=47654 DPT=4949 WINDOW=256 RES=0x00 ACK PSH FIN URGP=0

UPDATE: output of iptables -L -v

share|improve this question
It might be worth using tcpdump to capture an entire connection with that blocked packet at the end of it. The way it got to a state where the firewall would block that packet might be enlightening. – Ladadadada Dec 22 '12 at 15:36
up vote 0 down vote accepted

Can you show all your rules? For solve your problem, just make rules:

/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
share|improve this answer
I've updated my question and added a link to the iptables rules – Yoav Aner Dec 22 '12 at 16:47
I was hoping for a more fine-grained method of allowing (stateful) access on the lo interface. However, this seems like the easiest way to avoid those false alarms. In case anybody's interested - in fwbuilder you can mark a rule as a stateless rule (in rule options). And it would produce a similar iptables rules as @sub specified. – Yoav Aner Dec 24 '12 at 11:46

You are only allowing -m state --state NEW. Assuming you also have a RELATED, ESTABLISHED rule somewhere, you will see a few packet denies like above, with ACK PSH FIN or some other non-new flags that the kernel state tracker doesn't recognize as a part of an established or related connection. Usually this happens shortly after you restart iptables and thus reload the connection tracking modules.

share|improve this answer
yes, I do have a rule allowing all RELATED, ESTABLISHED states. I'm seeing this in the log every 5 minutes or so, which is how frequently munin runs locally (and successfully connects). Any idea how to get rid of this error / allow these ACK PSH FINs ?? – Yoav Aner Dec 22 '12 at 16:42

You deny INVALID and UNTRACKED packets on your loopback interface.
This can cause icmp packtes amongst others get dropped.

Check out and man iptables

share|improve this answer
if I'm reading the log correctly, iptables dropped a TCP packet, not ICMP here. – Yoav Aner Dec 22 '12 at 16:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.