Red Hat Bugzilla – Bug 159388
iptables does not allow packets on loopback with kernel-2.6.11-1.27_FC3
Last modified: 2007-11-30 17:11:07 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050513 Fedora/1.0.4-1.3.1 Firefox/1.0.4
Description of problem:
The following iptables script should allow all packets on the loopback, but drop everything else:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o lo -m state --state NEW -j ACCEPT
iptables -A OUTPUT -j DROP
iptables -A INPUT -j DROP
When you run this with kernel-2.6.11-1.14_FC3 everything works as expected, but with kernel-2.6.11-1.27_FC3 all packets are dropped, even those on the loopback. I'm using iptables-1.2.11-3.1.FC3.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. boot 2.6.11-1.27_FC3
2. add rules as above
3. telnet 127.0.0.1 25 (or anything else on the loopback)
4. boot 2.6.11-1.14_FC3
5. add rules, telnet to loopback
6. Connection accepted
Actual Results: Packets dropped
Expected Results: Packet on loopback should be allow (as in 2.6.11-1.14_FC3)
Created attachment 115080 [details]
sucessful tcpdump using kernel-2.6.11-1.14_FC3
Created attachment 115081 [details]
failed connection using kernel-2.6.11-1.27_FC3
Failed connction using kernel-2.6.11-1.27_FC3
The only networking changes between .14 and .27 was a rebase from 184.108.40.206 to
220.127.116.11. Nothing obvious jumps out at me looking at the interdiff, but perhaps
davem has clues..
This could be..
which would make this bug a dupe of 158710
Yes, I believe it is the same exact checksumming bug.
*** This bug has been marked as a duplicate of 158710 ***
Similar problem experienced with APF Firewall (which uses IPtables). Whilst I am
still figuring out the mechanics (new to this), kernel-2.6.11-1.27_FC3 drops any
loopback packets with APF running, no problems when its not running. No such
problem with 2.6.11-1.14_FC3.
Running on i686.
as mentioned in the bug this is a dupe of, theres a test kernel available on my
people page that should fix this. (link is in the other bug)