build in firewall nftables - please do not filter on loopback

[khorsmann]

Hi @hnimminh ,

in my lab i use an ssh-tunnel to push changes to libresbc. this works only if i change the default template and allow anything on loopback. thats imho also the best practice not to "flter" on loopback. I assume deployment with ansible rsync on the same maschine will work also then. anyhow due the "drop" default policy - you think something is broken. Its not, its firewalled.

Best
Karsten

[hnimminh]

Hi @khorsmann,

• Can you share me the reason to use the ssh-tunnel? - usually, configuration should be done via HTTP API for secure it can be done on ip whitelist or inventory firewall.
• Since the last issue when you run with ansible on the same host, seem like it is not a cause, so that can you confirm your assumption by rerun without loopback filter? I'm interesting to know.
• How do you think about the IP spoofing with loopback? event no replies as inside loopback, but unidirectional attacks is possible.

[khorsmann]

For the first point I describe your me test server, it's an vm with public IP. I use an vpn for the api but my colleague use an ssh tunnel. I don't want to whitelist his dynamic ip every time it changed and I don't want to open the api to the howl world.

The second point I will test this week and report.

For the faked udp stuff normally an Kamailio blocks that or an firewall. Also for example the openbsd pf.conf firewall FAQ skips loopback and filters on egress and ingress the RFC1918 networks if needed.