mjhjmtu

I am doing some testing and want to be able to test situations where my database goes down. Its running on the same box as my tests, and it appears that things like the following are not doing the trick

iptables -A INPUT -p tcp --dport 25262 -j DROP
iptables -A INPUT -p tcp --sport 25262 -j DROP
iptables -A INPUT -p tcp --dport 25262 -i lo -j DROP
iptables -A INPUT -p tcp --dport 25262 -s 127.0.0.1 -j DROP

I am about to resort to killing my database process, move the file (because my database automatically comes back up on a crash), and let the test continue that way, but that seems like a terrible way to do it.

What is the right way to block a port on loopback?

Command line command to DROP all loopback traffic (lo0)

$ [sudo] iptables -I INPUT --dport 25262 -i lo -j DROP

Explanation

Because iptables evaluates rules top to bottom and works on on a "first match wins" basis, you need to make sure your -i lo DROP rule is -I inserted to the top rather than -Aappended to the bottom of the rules, so it matches before another rule accepts the loopback traffic, e.g. if your DB was MySQL this rule might also match

INPUT -p tcp --dport 3306 ACCEPT

so if you did command:

$ [sudo] iptables -A INPUT --dport 25262 -i lo -j DROP
 ^^^ Notice the difference

your rules would look like this:

INPUT -p tcp --dport 3306 ACCEPT ---> this "wins" and request is accepted
INPUT --dport 25262 -i lo -j DROP

by running:

$ [sudo] iptables -I INPUT --dport 25262 -i lo -j DROP

your final rules would look like:

INPUT --dport 25262 -i lo -j DROP ---> this "wins" and request is DROP'ed
INPUT -p tcp --dport 3306 ACCEPT 
... all your other rules

Loopback on.my android seems to be controlled using edge browser on win 7 laptop not sure if its update to 10 but in all this is doing all the watching reading listening and she REALLY OUGHT TO JUST KNOCK IT ALL OFF BEFORE ITS TOO LATE