X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/bfdc045deb6149808d309b4ac3c292d9c57a8b38..12ac65a1e0d1d8083bdbf50154248a0c5110a2b2:/bookends.m4

diff --git a/bookends.m4 b/bookends.m4
index f99066c..6b4f5f4 100644
--- a/bookends.m4
+++ b/bookends.m4
@@ -81,15 +81,25 @@ errorchain mangle:bad-source-address DROP
 ## Packet arrived on wrong interface for its source address.  Drops the
 ## packet, since there's nowhere sensible to send an error.
 
+errorchain bad-destination-address REJECT --reject-with icmp-host-prohibited
+## Packet arrived on non-loopback interface with loopback destination.  Sends
+## a rude note back.
+
 errorchain interesting ACCEPT
 ## Not an error, just log interesting packets.
 
 m4_divert(36)m4_dnl
 ###--------------------------------------------------------------------------
-### Don't clobber local traffic.
+### Standard loopback stuff.
 
+## Don't clobber local traffic
 run iptables -A INPUT -i lo -j ACCEPT
 
+## We really shouldn't see packets destined for localhost on any interface
+## other than the loopback.
+run iptables -A INPUT -g bad-destination-address \
+	-d 127.0.0.0/8
+
 m4_divert(90)m4_dnl
 ###--------------------------------------------------------------------------
 ### Finishing touches.