Assigning static IP address other than 127.0.0.0/8 to loopback interface

Question

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to connect to an nginx/apache run server on that IP regardless of interface they are connecting through (i.e. en or wl).

auto lo
iface lo inet loopback
     post-up /sbin/ip addr add 192.168.1.200/32 dev lo

The firewall has port forwarding to this IP (192.168.1.200) for ports 40 and 443.

The servers is on the small office LAN which handles sensitive data and a couple of workstations. Our key risks are:

1. Motivated hacker compromising sensitive data stored on a separate Samba server on the same LAN;
2. Ransomware attacks.

QUESTION: is this IP binding would be less safe in comparison to using a regular static IP address assignment to a single adapter (rather than to localhost), or they are indistinguishable? Any other advice regarding the use of this approach - bad/good/neutral?

Answer 1

I see a number of answers here about the use of binding IP addresses to loopback interfaces. To be clear, this is not uncommon. It's actually something that is done quite often, for example to create a virtual IP address floating that can move (automatically or manually) from one machine to another with a high availability protocol. The loopback interface is always available on any device, which makes it a good interface to bind the address to.

Also, binding IP addresses to loopback interfaces is often used when a device has multiple network connections, and you don't care about which interface is used to reach the device, you just want to communicate with the specific device regardless of the way it's reached. This is used for example when a machine is using a routing protocol like OSPF and BGP and does dynamic routing.

Now back to your question: is this a good thing security wise? I don't think that in the situation you're describing this offers any real benefit to just adding the IP address to a physical interface and adding proper firewall rules there. In fact, you could argue that the added complexity increases the chances of someone forgetting to apply the rules correctly. Also, if multiple interfaces are available on the device, you need to apply the firewall filters on all interfaces. Personally, I wouldn't use a setup like this if your only goal would be to increase security. Everything you're doing there can be done with a nearly identical firewall filter on the physical interface.

Answer 2

While I can't think of a reason to use such a configuration, I also can't think of any security issues with it. As long as you intend to make the services available to all attached networks and publicly as you mentioned, there shouldn't be an issue.

Regardless of the configuration, you may benefit from a host-based firewall to ensure only the intended services are available.

Answer 3

the loopback interface is supposed to be reserved by the IP protocol, as well as the 127.0.0.1 IP address, if you change the system's loopback address, this may break something else, now or in the future. those are reserved for a reason.

I don't think it is a good idea to change such basic config to solve a common problem, it may be healthier for the system to have the regular configurations with two interfaces (wl and eth) with their own IP address and a server assigned to each.

Besides this, you may experience some problems troubleshooting if you can't distinguish the wireless from the ethernet communications in the logs.