I have setup my Ubuntu server as a router and webserver by following the answer given here. My ISP facing interface eth0
has a private 172.16.x.x/30 ip and my lo
interface has a public IP as mentioned in the answer to the question linked above. The setup is working well. The only snag I have experienced is that I could not find a way to block the ports exposed by the public IP on the lo
interface. I tried doing iptables -A INPUT -i eth0 -j DROP
, and my server lost connectivity to the public network (internet). I could not ping any public ips. What I want is a way to block ports that are exposed by the public ip on the lo
interface. And also I require iptables rules that can expose ports like 80
or openvpn port to the public network.
2 Answers
loopback interfaces should NEVER have any address besides a 127.0.0.0/8 one. More than likely, the person who built the image for your setup (ec2 perhaps?) put that in there for convenience. It is unlikely that the loopback interface sees any public traffic whatsoever. It's probably natted to you through your 172 address... and as such, firewall rules should be applied to that interface.
-
It's not ec2 setup. I run a physical server. I subscribe to a Leased Internet Link. The ISP has assigned me a
/29
public subnet. But ISP routes to me that public subnet via a/30
private subnet. My server is connected to ISP via that/30
private subnet. Jul 3, 2012 at 17:25 -
1Still... the "lo" interface is nothing more than an internal loopback interface. It is not assigned to any physical network card, and traffic is not routed through it outside of the local machine. The only reason someone would assign a public ip-address to a loopback interface is for convenience to things running locally. Firewall rules should be applied to the interface assigned to the 172 address space... (or which ever interface is connected to your ISP) Jul 3, 2012 at 17:37
If I well understand your setup, your trafic is coming via eth0 interfaces and forwarded to the lo interfaces.
Have you try to put a FORWARD rule instead of a INPUT rule ?
lo
have a public IP? o.O/29
subnet via private30
subnet. I connect to ISP via the private/30
subnet. I cannot afford to have two routers to do WAN routing and NATing. So it's a hack to get one Ubuntu server work as WAN router, NAT router and webserver.