Hi, yes - sorry, forgot to mention this. Didn't want to make too much noise... Next time I'll write if "merged or not". ;-) Matthias On 19.05.2020 10:21, Michael Tremer wrote: > Hi, > > False alarm. Turns out this isn’t merged, yet. > > Best, > -Michael > >> On 19 May 2020, at 09:20, Michael Tremer wrote: >> >> Okay, thanks for testing this. >> >> I will ask Arne to revert it. >> >> -Michael >> >>> On 18 May 2020, at 22:03, Matthias Fischer wrote: >>> >>> Hi, >>> >>> perhaps its only me, but after applying this patch for testing purposes >>> I don't see any (redirected) urlfilter block pages anymore. >>> >>> Only the firewall logs are telling me: >>> >>> ... >>> REJECT_INPUT lo TCP 192.168.100.254 53464 192.168.100.254 81 >>> ... >>> >>> I had to build a new "Incoming Firewall Access" rule (INPUTFW) allowing >>> TCP traffic from (e.g.) 192.168.100.254/32 to GREEN (192.168.100.254) to >>> TCP port 81 to see a block page again... >>> >>> Only me? >>> >>> Best, >>> Matthias >>> >>> On 14.05.2020 12:36, Michael Tremer wrote: >>>> Hello, >>>> >>>> This is indeed *very* unlikely, but I am okay with this patch being accepted. >>>> >>>> Acked-by: Michael Tremer >>>> >>>> Best, >>>> -Michael >>>> >>>>> On 13 May 2020, at 21:21, Peter Müller wrote: >>>>> >>>>> This ensures traffic on the loopback interface matches the IPv4 >>>>> loopback characteristics (source and destination are within 127.0.0.0/8) >>>>> and prevents any damage in the unlikely case of non-loopback traffic >>>>> being injected/emitted (in)to the loopback interface. >>>>> >>>>> Cc: Arne Fitzenreiter >>>>> Cc: Michael Tremer >>>>> Signed-off-by: Peter Müller >>>>> --- >>>>> src/initscripts/system/firewall | 6 +++--- >>>>> 1 file changed, 3 insertions(+), 3 deletions(-) >>>>> >>>>> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall >>>>> index 00512d9fa..409aaf7a9 100644 >>>>> --- a/src/initscripts/system/firewall >>>>> +++ b/src/initscripts/system/firewall >>>>> @@ -219,10 +219,10 @@ iptables_init() { >>>>> iptables -A INPUT -j ICMPINPUT >>>>> iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT >>>>> >>>>> - # Accept everything on loopback >>>>> + # Accept everything on loopback if both source and destination are within 127.0.0.0/8 >>>>> iptables -N LOOPBACK >>>>> - iptables -A LOOPBACK -i lo -j ACCEPT >>>>> - iptables -A LOOPBACK -o lo -j ACCEPT >>>>> + iptables -A LOOPBACK -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT >>>>> + iptables -A LOOPBACK -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT >>>>> >>>>> # Filter all packets with loopback addresses on non-loopback interfaces. >>>>> iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP >>>>> -- >>>>> 2.26.1 >>>> >>> >> >