0

I have a couple of servers with the below config

server1:

lo: 127.0.0.1/16  scope host
eno1: 127.15.0.1/16 scope global
eno2: 5.0.0.1/24

server2:

lo: 127.0.0.1/16 (it had /8. I changed the subnet mask using 'ip addr del 127.0.0.1/8 dev lo; ip addr add 127.0.0.1/16 dev lo')
eno2: 5.0.0.2/24

eno1 of server1 is connected to a completely different L2 network and is completely isolated.

eno2 interfaces of both servers are connected to the same L2 network. Now i have to access 127.15.0.1 from server2.

Server1 was deployed long back and i dont have permissions to change any sort of config. I dont know why some one used 127.x.x.x subnet with scope global. Not sure if it is a valid config but i have to live with it. I have complete control on the server2 and i can change anything.

Both servers are linux based.

connectivity between 5.0.0.1 <-> 5.0.0.2 is good.

My first try was to add a route in server2 as below

ip r add 127.15.0.1/32 via 5.0.0.1

pinged 127.15.0.1 from server2. I see the ping requests and replies in tcpdump on server2, but ping command is showing 100% loss.

I disabled rp_filters

sysctl.cnf:
    
    net.ipv4.conf.all.rp_filter=0
    net.ipv4.conf.default.rp_filter=0
    net.ipv4.conf.lo.rp_filter=0
    net.ipv4.conf.eno2.rp_filter=0

rebooted after updating sysctl.conf

And i flushed out the iptables. (iptables -F)

Same result. I thougt may be server2 doesnt like using 127.x.x.x series. So i added the below rule on server 2

iptables -t nat -A OUTPUT  -d 5.0.0.1 -j DNAT --to-destination 127.15.0.1

this rule is supposed to replace destination ip to 127.15.0.1 if packet is destined to 5.0.0.1.

pinged 5.0.0.1 from server2. Iptables replaced the destination ip with 127.15.0.1(confirmed this on server1 tcpdump). Server1 replied but the replies are dropped again.

I ran out of ideas at this point. I took down server1 for maintenance and replaced 127.15.0.1/26 with 192.168.1.1/16. Connectivity worked fine in this case (with and without iptables). Now the question is, is the issue because of using 127.x.x.x? If yes, is there a way out of it?? If no, what else can i try?

Note: This config was working before. We recently lost server2 (which had old linux) and i am building it from scratch.

3
  • Sorry, host configurations and issues are off-topic here. Most stacks simply won't work (and shouldn't) with an address from 127.0.0.0/8 bound to a NIC.
    – Zac67
    Aug 30 at 17:36
  • 127/8 is loopback - period. Any system that allows any use otherwise is violating specs. (i.e. it work with anything else.) Yes, you can easily modify linux to allow this perversion. (it's a single line change. I've pointed this out before.)
    – Ricky
    Aug 30 at 18:46
  • Cross posting a question to multiple SE sites is not allowed. You may find cross-posted questions closed on all the sites where they are cross posted.
    – Ron Maupin
    Aug 30 at 20:08
2

To quote RFC5735:

127.0.0.0/8 - This block is assigned for use as the Internet host loopback address. A datagram sent by a higher-level protocol to an address anywhere within this block loops back inside the host. This is ordinarily implemented using only 127.0.0.1/32 for loopback. As described in [RFC1122], Section 3.2.1.3, addresses within the entire 127.0.0.0/8 block do not legitimately appear on any network anywhere.

Using any address in the 127.0.0.0/8 range for communication between hosts should not work. For local networks, any IP range defined in RFC1918 can be used.

3
  • Thank you and I completely agree with you. But I do have few more similar setups in lab where they used 127.x.x.x series IPs on non-loopback interfaces. And these setups are still working. So I was wondering if I am missing something or may be there is a hack in linux to use these subnets.
    – RBK050
    Aug 30 at 11:50
  • 2
    Host configuration questions are off topic here. You can consider asking that on Super User for a personal setup, or on Server Fault for an enterprise setup, but the only good thing to do here is to pick a range which is designed to work, instead of trying to work around the problem.
    – Teun Vink
    Aug 30 at 11:52
  • Thank You. I wish I had the liberty to use the proper subnet. Will ask in super user or server fault.
    – RBK050
    Aug 30 at 11:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.