Iptables – memcached and iptables

iptablesmemcached

$m = new Memcached();
$m->addServer('localhost', 11211);

Will port 11211 need to be open in IPTables for this to work, or is it bypassed considering it's localhost?

sudo iptables -L -n -v output

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
1155K   95M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
8817K 1451M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate RELATED,ESTABLISHED 
  183 10452 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:6685 
 574K   30M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
  122  7232 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
 2649  154K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 8343K packets, 12G bytes)
 pkts bytes target     prot opt in     out     source               destination         
    6  2524 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:20

Best Answer

What everyone else has noted about default installs is fairly true, though most eg CentOS systems have come out of the box running a basic firewall for some time now. But even a basic firewall will normally allow all connections from localhost to localhost, as is it extremely unwise to forbid these; the oddest things can start happening. If there's a line near the top of your INPUT chain (or any chain to which INPUT delegates the bulk of its work) that says

iptables -A INPUT -i lo -j ACCEPT

or in iptables -L -n -v format, 

  840 97979 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

(never mind the first two fields, they're packet and byte counts and yours would of course be different) then you're probably OK. Another good test is to do

telnet localhost 11211

if you get 

Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).

then you know your listener's running and the firewall's not blocking it. Failing that, give us your iptables -L -n -v and your netstat -an outputs, as the others suggest, so we can take a look.

Related Topic