0

For the sake of the example, assume gateway to be 10.0.0.1 and host A (my machine) to be 10.0.0.2.

If gateway (10.0.0.1) is running a service bound to a port on localhost only, the service should be inaccessible to anyone on the network. However, if I configure machine A (10.0.0.2) to route all traffic to 127.0.0.1 through 10.0.0.1, would 10.0.0.1 then route those packets to itself? Is my assumption correct that packets sent to 127.0.0.1 regardless of their source will be sent to that address and therefore, packets which leave localhost but are addressed to 127.0.0.1 will become addressed to the next "hop"'s loopback? Does it largely depend on the network and gateway or does it work/not work in most cases?

A transcript of what I mean:

10.0.0.1 - "Hey! Send this to 127.0.0.1 for me, 10.0.0.1?"
10.0.0.2 - "Sure!"
10.0.0.2 - *oh, that's me*
10.0.0.2 - "Here's the reply 127.0.0.1 (I) gave, 10.0.0.2"
10.0.0.1 - "Thanks!"

I'm not sure if that makes sense, or is possible at all, but if so that would probably be a pretty big security hole for machines running local-only services and forwarding other machines' traffic.

  • This is a routing question, not a security question. – schroeder Jun 7 at 15:59
  • @schroeder in that case, should I re-post it somewhere else? Or wait for it to be moved? I posted it here thinking it fits under "network security". – TR_SLimey Jun 7 at 16:00
1

You cannot route any traffic destined to any address in the 127.0.0.0/8 block on an external network. Any address in the 127.0.0.0/8 block can never appear anywhere on any network, nor can any address in that block be used as a source or destination address for packets outside the host.

The goes back at least as far as RFC 990, ASSIGNED NUMBERS:

The class A network number 127 is assigned the "loopback" function, that is, a datagram sent by a higher level protocol to a network 127 address should loop back inside the host. No datagram "sent" to a network 127 address should ever appear on any network anywhere.

-and-

RFC 1122, Requirements for Internet Hosts -- Communication Layers:

(g) { 127, }

Internal host loopback address. Addresses of this form MUST NOT appear outside a host.

-and-

RFC 1700, Assigned Numbers:

(g) {127, }

Internal host loopback address. Should never appear outside a host.

-and-

RFC 3330, Special-Use IPv4 Addresses:

127.0.0.0/8 - This block is assigned for use as the Internet host loopback address. A datagram sent by a higher level protocol to an address anywhere within this block should loop back inside the host. This is ordinarily implemented using only 127.0.0.1/32 for loopback, but no addresses within this block should ever appear on any network anywhere [RFC1700, page 5].

-and-

RFC 5735, Special Use IPv4 Addresses:

127.0.0.0/8 - This block is assigned for use as the Internet host loopback address. A datagram sent by a higher-level protocol to an address anywhere within this block loops back inside the host. This is ordinarily implemented using only 127.0.0.1/32 for loopback. As described in [RFC1122], Section 3.2.1.3, addresses within the entire 127.0.0.0/8 block do not legitimately appear on any network anywhere.

That means that Host A cannot route packets destined to 127.0.0.1 to a gateway on the network because that address cannot appear on the network as a destination address.

| improve this answer | |
  • Thanks for the answer. I understand that this is not standards compliant, but surely it is possible to send out a packet with the destination header set to 127.0.0.1 using some non-standards-compliant software? In any case I assume this means that a packet like this appearing would cause undefined behaviour since devices are not equipped to deal with one? Unless you mean that such packet somehow can never be created even using non-compliant software? – TR_SLimey Jun 7 at 17:00
  • What you are asking in your comment is off-topic here. What applications, and hosts/servers do it off-topic here. – Ron Maupin Jun 7 at 17:03
  • That's what I thought too hence why I originally posted in security. Either way, I think I more or less understand. Thanks. – TR_SLimey Jun 7 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.