1

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary.

What's the purpose of this configuration, and is it really secure?

1
  • This question sounds a bit off-topic to me. You'll probably get better answers if you ask this on a Linux-oriented Stack Exchange web site, like askubuntu.com. Apr 19, 2014 at 13:33

1 Answer 1

2

It can be useful for anything where you want the box to be able to connect to itself but not allow other boxes to connect.

A good example would be a web server running Wordpress and MySQL. You don't want anyone on the web to be able to connect to the SQL server but you want to point Wordpress at 127.0.0.1 for SQL.

There may be some obscure side channel risk, for example if you had a vulnerable version of MySQL running. It might be firewalled off from the rest of the world but a local user could use for privilege escalation. But generally I can't see any problem with it because loopback can only be accessed if your already on the box.

Also I have a feeling it might be used for the box to resolve itself and blocking it could cause errors like "sudo: unable to resolve host [hostname]" but I might be wrong about that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .