From 57861cb8ece5422fb94758f49a780ba8dd79ff4d Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Tue, 27 Oct 2026 22:30:44 +0100
Subject: [PATCH] Enhance spoofed packet handling: exclude loopback traffic in
 IP filtering

---
 conf/post_declarations.conf | 2 +-
 ip6t-firewall-server        | 9 +++++++--
 ipt-firewall-server         | 9 +++++++--
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/conf/post_declarations.conf b/conf/post_declarations.conf
index e6a8137..160f339 100644
--- a/conf/post_declarations.conf
+++ b/conf/post_declarations.conf
@@ -60,7 +60,7 @@ done
 # ---
 declare -a ext_ip_arr
 for _ip in $ext_ips ; do
-   host_ip_arr+=("$_ip")
+   ext_ip_arr+=("$_ip")
 done
 
 # ---
diff --git a/ip6t-firewall-server b/ip6t-firewall-server
index 1b9ea02..144d3bd 100755
--- a/ip6t-firewall-server
+++ b/ip6t-firewall-server
@@ -815,13 +815,18 @@ echo_done
 # ---
 
 echononl "\tBlock spoofed (own ip) packets"
+
+# Note:
+#   Exclude loopback - local traffic to an own address (e.g. a web application
+#   requesting its own domain) passes PREROUTING via 'lo' with src = dst.
+#
 if $log_spoofed || $log_all ; then
    for _ip in ${ext_ip_arr[@]} ; do
-      $ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
+      $ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
    done
 fi
 for _ip in ${ext_ip_arr[@]} ; do
-   $ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
+   $ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
 done
 echo_done
 
diff --git a/ipt-firewall-server b/ipt-firewall-server
index c1b379e..caec103 100755
--- a/ipt-firewall-server
+++ b/ipt-firewall-server
@@ -814,13 +814,18 @@ echo_done
 # ---
 
 echononl "\tBlock spoofed (own ip) packets"
+
+# Note:
+#   Exclude loopback - local traffic to an own address (e.g. a web application
+#   requesting its own domain) passes PREROUTING via 'lo' with src = dst.
+#
 if $log_spoofed || $log_all ; then
    for _ip in ${ext_ip_arr[@]} ; do
-      $ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
+      $ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
    done
 fi
 for _ip in ${ext_ip_arr[@]} ; do
-   $ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
+   $ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
 done
 echo_done