Cleanest way to deal with loopback interface?

Jason Opperisano opie at 817west.com
Thu Apr 14 03:35:25 CEST 2005


On Wed, Apr 13, 2005 at 04:57:53PM -0700, Christian Seberino wrote:
> Thank you very much!
> Are you saying that there is no reason for firewalls to check for and
> drop packets addressed to and from 127.0.0.1 because Linux TCP stack
> already drops those automatically?  I didn't know source IP addresses
> were checked by default.  This is almost like a built in 'always on'
> firewalling on Linux!?
> 
> In other words, if I tried to spoof packets to your LAN from 127.0.0.1,
> they would never get through even with no firewalls?

yeah--somewhere around line 1434 of:

  /usr/src/linux-2.4.28/net/ipv4/route.c

on the machine i'm looking at.

-j

--
"Chris: Hi, my name is Chris. Mom and dad said that I'm supposed to be
 on my best behavior tonight and not say "poop". Oh god. What have I
 done?"
        --Family Guy



More information about the netfilter mailing list