On 23.02.2009 06:32, Michael S. Zick wrote: > In general, that is just the way "host local" is done in the network stack. > "host" here being the usage in network terminology. > Both "127.0.0.1" and the assigned machine IP address the same machine. > Call it a feature. > > In the newer VServer setups, you have the *option* to give each "guest" > an "lo A.K.A: 127.0.0.0/8" interface. > > So, more info needed: > > what context where you in (VServer host or Vserver guest) when you > typed the telnet command? > I did everything, except the tcpdump, from inside the same guest. I just did it again and now the output looks even more strange (to me): firewall (dropped):IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=55.31.151.23 DST=127.179.126.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=61080 DF PROTO=TCP SPT=44517 DPT=4456 WINDOW=32792 RES=0x00 SYN URGP=0 It seems the "real" IP of the guest is chosen this time to connect to the local interface, not even a random 127.0.0.1/8 one. > how did you configure the VServer kernel? Isolated lo or not? I didn't build the kernel myself, I use the precompiled one from debian. The config looks like this ~# cat /boot/config-2.6.26-1-vserver-amd64 | grep -i vser # Linux VServer CONFIG_VSERVER_AUTO_LBACK=y # CONFIG_VSERVER_AUTO_SINGLE is not set CONFIG_VSERVER_COWBL=y # CONFIG_VSERVER_VTIME is not set # CONFIG_VSERVER_DEVICE is not set CONFIG_VSERVER_PROC_SECURE=y CONFIG_VSERVER_HARDCPU=y CONFIG_VSERVER_IDLETIME=y CONFIG_VSERVER_IDLELIMIT=y CONFIG_VSERVER_PRIVACY=y CONFIG_VSERVER_CONTEXTS=768 CONFIG_VSERVER_WARN=y # CONFIG_VSERVER_DEBUG is not set CONFIG_VSERVER=y CONFIG_VSERVER_SECURITY=y Is it correct that 127.0.0.1/8 is local to each vserver and so adding a general rule like $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and doesn't expose any security flaws between different vserver guests? Thanks, Corin