Securing the Network in Oracle^® Solaris 11.3

How to Enable Loopback Filtering

Before You Begin

You must become an administrator who is assigned the IP Filter Management rights profile and the solaris.admin.edit/path-to-IPFilter-policy-file authorization. The root role has all of these rights. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.3.

1. Stop IP Filter if it is running.

   # svcadm disable network/ipfilter

2. Add the following rule at the beginning of your IP Filter policy file.

   set intercept_loopback true;

   Use the pfedit command, as in:

   # pfedit /etc/ipf/myorg.ipf.conf

   This line must precede all block and pass rules that are defined in the file. However, you can insert comments before the line, similar to the following example:

   ...
   #set defrag off;
   # 
   # Enable loopback filtering to filter between zones 
   # 
   set intercept_loopback true; 
   # 
   # Define policy 
   # 
   block in all 
   block out all 
   other rules

3. Enable IP Filter.

   # svcadm enable network/ipfilter

4. To verify the status of loopback filtering, use the following command:

   # ipf -T ipf_loopback
   ipf_loopback    min 0   max 0x1 current 1
   #

   If the value of current is 0, loopback filtering is disabled. If current is 1, loopback filtering is enabled.