Profile Applicability:
 • Level 1

Description:
 Loopback traffic is network communication within the local host using the loopback interface (lo). Properly configuring nftables to allow and handle loopback traffic ensures essential local processes communicate securely without unnecessary filtering.

Rationale:
 Allowing loopback traffic maintains normal system operation and prevents unintended interference with internal communications, which are critical for many system functions.

Impact:
 Pros:

  • Ensures system components communicate effectively via loopback.

  • Prevents disruption of local services and applications.

Cons:

  • Misconfiguration may inadvertently block necessary loopback traffic.

Default Value:
 Loopback traffic may not be explicitly allowed in nftables until configured.

Pre-requisites:

  • Root or sudo privileges to manage nftables configuration.

Remediation:

Test Plan:

Using Linux command line:

1. List nftables rules for the loopback interface:

nft list chain inet filter input

2. Verify rules exist to accept traffic on the lo interface.

Implementation Plan:

Using Linux command line:

1. Add rules to accept loopback traffic, for example:

nft add rule inet filter input iif lo accept
nft add rule inet filter output oif lo accept

2. Verify rules are added:

nft list chain inet filter input  
nft list chain inet filter output

Backout Plan:

Using Linux command line:

1. Delete loopback acceptance rules if needed:

nft delete rule inet filter input handle <handle_number>
nft delete rule inet filter output handle <handle_number>

2. Verify rules removal.

References:

  • CIS Amazon Linux 2 Benchmark v3.0.0

  • nftables Documentation

  • Linux Loopback Interface