Enhance spoofed packet handling: exclude loopback traffic in IP filtering

ipt-firewall-server

@@ -814,13 +814,18 @@ echo_done
 # ---
 
 echononl "\tBlock spoofed (own ip) packets"
+
+# Note:
+#   Exclude loopback - local traffic to an own address (e.g. a web application
+#   requesting its own domain) passes PREROUTING via 'lo' with src = dst.
+#
 if $log_spoofed || $log_all ; then
    for _ip in ${ext_ip_arr[@]} ; do
-      $ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
+      $ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
    done
 fi
 for _ip in ${ext_ip_arr[@]} ; do
-   $ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
+   $ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
 done
 echo_done