2

I have set up a VPN client and I'm using iptables to block all connections not tunneled through the VPN. An example of the iptables rules I am using can be found here.

Unfortunately with this configuration RStudio does not start up.

In fact the RStudio guide says:

Check firewall, proxy settings, and antimalware

Although RStudio does not require internet access, it does use a localhost connection to link your R session with the RStudio IDE. As a result, it is possible a (software-based) firewall, network setting, or antimalware program is blocking access to RStudio. If you have a firewall, HTTP or HTTPS proxy configured, add localhost and 127.0.0.1 to the list of approved Hosts and Domains. After this, try restarting RStudio. If you have antimalware software configured that may be blocking RStudio, please check its settings and whitelist RStudio if necessary.

I had already allowed outgoing connections on the loopback interface:

-A OUTPUT -o lo -j ACCEPT

By experimentation I have discovered that adding this line to the rules would make RStudio work again:

# Accept localhost
-A INPUT -d 127.0.0.1/24 -j ACCEPT

From a security perspective, is such a rule safe?

Can such a rule be exploited by malware/spyware?

Will such a rule leak my private IP address despite the VPN connection?

EDIT: Is the rule:

-A INPUT -s 127.0.0.1/24 -d 127.0.0.1/24 -j ACCEPT

safer? Also this rule would make RStudio work

EDIT2: Should the mask be /8 and not /24?

Improve this question

2 Answers 2

Reset to default
1

What you want to do can indeed be done safely. The canonical rule to do so isn't the one you used, though. It's this: -A INPUT -i lo -j ACCEPT

Improve this answer
0

The localhost in general is used to verify that the TCP/IP stack is correctly working on the host for example. Some programs use localhost for communicate process on the same host. Is very common to do what your RStudio is telling. Bear in mind that you can not ping externally to localhost from other host, localhost is only accessible on your host, so I don't see any problem of having that iptables rules, wait other answers :)

Hope it helps

Improve this answer
2
  • Thank you very much. Should the mask be /8 and not /24?
    – robertspierre
    Mar 1, 2021 at 22:33
  • You can have multiple IPs on the same device, but in general localhost have just one, so probably with a /32 will be fine, not sure why you want to have /8 or /24. Localhost connections have source IP 127.0.0.1 and destination 127.0.0.1 unless you have multiple IPs.
    – camp0
    Mar 2, 2021 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .