0

When I executed this IPTables command: iptables -A INPUT -p tcp -m tcp --dport 9080 -s localhost -d localhost -j ACCEPT

iptables -L shows:

ACCEPT     tcp  --  localhost            localhost            tcp dpt:9080
ACCEPT     tcp  --  localhost            localhost            tcp dpt:9080
ACCEPT     tcp  --  localhost            localhost            tcp dpt:9080
ACCEPT     tcp  --  localhost            localhost            tcp dpt:9080

Why four times? I mean, it does what I want, but why does it need to show four times?

edit: All of the commands entered to reproduce this (multiple times) on my side are:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -d 192.99.169.167/32 -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

iptables -A INPUT -s localhost -d localhost -p tcp -m tcp --dport 9080 -j ACCEPT

iptables -A INPUT -s localhost -d localhost -p tcp -m tcp --dport 9081 -j ACCEPT

iptables -A INPUT -j DROP
iptables -P INPUT DROP
  • 2
    FYI: you may want to include the -v option. I doubt it applies to your case, but without the -v option some information is not displayed as part of the list. I usually use iptables -vnL. – Zoredache Aug 10 '14 at 6:36
  • @Zoredache: Thank you! I'm using that now, it helps a lot actually! – jdersen Aug 10 '14 at 6:41
3

It shouldn't, unless there is a bug. However, iptables -A is not idempotent, and if you run it multiple times (or run a redundant iptables -A command against an existing or loaded configuration), it will add the rule again whether or not it is an exact duplicate of a dispositive rule.

Another thing that might be happening is that resolution gives multiple results for the name localhost. This is very rare because best practice dictates against using names in iptables commands. You can inspect your /etc/hosts file to determine this, or you can use iptables -nL to show what the IPs are. In such a case, yes, it does need to add multiple rules for your request (since in this particular case it resolves and expands the names at insertion time), and you should probably be explicitly specifying 127.0.0.1 if that is what you want.

  • Please see my edit to see all the commands entered into a fresh iptables. As you can see, I only enter each command once and, as far as I know, none of them are redundant. – jdersen Aug 10 '14 at 6:25
  • Oh, I forgot about the unusual behaviour that results when people do this inadvisable thing. Enjoy. – Falcon Momot Aug 10 '14 at 6:35
  • What inadvisable thing? Sorry, I'm slightly a dunce at this :) Is it inadvisable to use 127.0.0.1 in IPTables? – jdersen Aug 10 '14 at 6:36
  • 1
    Ah! Both my IPv6 and IPv4 addresses were resolving for localhost, and -s and -d added their own equaling 4 total entries. Thank you for your help :) I will use specific numbers from now on!! – jdersen Aug 10 '14 at 6:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.