I had a look at the iptables rules from Tails OS

Briefly speaking, what is the purpose of the lan iptables rules?

Chain lan (3 references)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere             tcp dpt:domain reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpt:domain reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             owner UID match postgres reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere  

They allow access to local network resources but deny DNS and the i2p service, to prevent accidental leaks.

From ferm.conf:

        # Local network connections should not go through Tor but DNS shall be
        # rejected. I2P is explicitly blocked from communicating with the LAN.
        # (Note that we exclude the VirtualAddrNetwork used for .onion:s here.)
        daddr ( @subchain "lan" {
            proto tcp dport domain REJECT;
            proto udp dport domain REJECT;
            mod owner uid-owner i2psvc REJECT;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.