Dante blocking some localhost connections

Question

I connect through a tunnel to Dante. It works but still blocks two of the apps that I need to work through the SOCKS proxy

Aug 28 14:20:24 (1377699624) danted[3519]: block(1): tcp/connect [: 127.0.0.1.51519 -> 127.0.0.1.30000
Aug 28 14:20:33 (1377699633) danted[3519]: block(1): tcp/connect [: 127.0.0.1.51527 -> 127.0.0.1.6112

That is what it says on the logs. My config is :

#Where are we going to log all those useful error messages?
logoutput: /var/log/dante.log

#What ip and port should Dante listen on,
# since I am only going to be using this via SSH 
#I only want to allow connections over the loopback
internal: 127.0.0.1 port = 1080

#Bind to the eth0 interface
external: eth0

#Since I am only accepting connections over the loopback, 
# the only people that COULD connect 
# would already be authenticated, 
# no need to have dante authenticate also
method: username none

#Which unprivileged user will Dante impersonate if need-be?
user.notprivileged: nobody

# Who can access this proxy?
# Accept only connections from the loopback, all ports
client pass {
  from: 127.0.0.0/8 port 1-65535 to: 0.0.0.0/0
}

#Block all other connection attempts
client block {
  from: 0.0.0.0/0 to: 0.0.0.0/0
  log: connect error
}

# Once connected, where can they go?
block {
  from: 0.0.0.0/0 to: 127.0.0.0/8
  log: connect error
}

#Pass from the internal IP to anywhere
pass {
  from: 192.168.0.0/16 to: 0.0.0.0/0
  protocol: tcp udp
}

#Pass from the loopback going anywhere
pass {
  from: 127.0.0.0/8 to: 0.0.0.0/0
  protocol: tcp udp
}

# Block everything else
block {
  from: 0.0.0.0/0 to: 0.0.0.0/0
  log: connect error
}

Do you know what happens here ? I'm pretty confused

Answer 1

You should read the documentation.

Dante rules are processed on a first-match basis, and all addresses match 0.0.0.0/0. So, rewrite those rules to do what you actually want, keeping the block rule at the end.

We have no information about what it does work for, but I'd have to assume the things it does work on aren't at localhost or aren't being proxied.

Something to bear in mind also is that when you access localhost through a proxy, the endpoint will be the proxy's loopback interface, not yours. However, as you're running the proxy on the same computer as you are accessing and hosting stuff (for some reason), it doesn't matter in this particular case. However, this is why blocking loopback on proxies is common.

Answer 2

You are blocking traffic from any ip to loopback ip. Fix your first "block" statement.