2

I have set up a VPN client and I'm using iptables to block all connections not tunneled through the VPN. An example of the iptables rules I am using can be found here.

Unfortunately with this configuration RStudio does not start up.

In fact the RStudio guide says:

Check firewall, proxy settings, and antimalware

Although RStudio does not require internet access, it does use a localhost connection to link your R session with the RStudio IDE. As a result, it is possible a (software-based) firewall, network setting, or antimalware program is blocking access to RStudio. If you have a firewall, HTTP or HTTPS proxy configured, add localhost and 127.0.0.1 to the list of approved Hosts and Domains. After this, try restarting RStudio. If you have antimalware software configured that may be blocking RStudio, please check its settings and whitelist RStudio if necessary.

I had already allowed outgoing connections on the loopback interface:

-A OUTPUT -o lo -j ACCEPT

By experimentation I have discovered that adding this line to the rules would make RStudio work again:

# Accept localhost
-A INPUT -d 127.0.0.1/24 -j ACCEPT

From a security perspective, is such a rule safe?

Can such a rule be exploited by malware/spyware?

Will such a rule leak my private IP address despite the VPN connection?

EDIT: Is the rule:

-A INPUT -s 127.0.0.1/24 -d 127.0.0.1/24 -j ACCEPT

safer? Also this rule would make RStudio work

EDIT2: Should the mask be /8 and not /24?

0

The localhost in general is used to verify that the TCP/IP stack is correctly working on the host for example. Some programs use localhost for communicate process on the same host. Is very common to do what your RStudio is telling. Bear in mind that you can not ping externally to localhost from other host, localhost is only accessible on your host, so I don't see any problem of having that iptables rules, wait other answers :)

Hope it helps

2
  • Thank you very much. Should the mask be /8 and not /24? Mar 1 at 22:33
  • You can have multiple IPs on the same device, but in general localhost have just one, so probably with a /32 will be fine, not sure why you want to have /8 or /24. Localhost connections have source IP 127.0.0.1 and destination 127.0.0.1 unless you have multiple IPs.
    – camp0
    Mar 2 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.