4
sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1

What are the security implications of route_localnet?

1

The documentation for this options shows the following:

route_localnet - BOOLEAN
    Do not consider loopback addresses as martian source or destination
    while routing. This enables the use of 127/8 for local routing purposes.
    default FALSE

In essence it tells the kernel not to treat local routing for as a danger and refuse it. As long as net.ipv4.ip_forward is 0 you shouldn't need to change route_localnet. In most cases you only need this when you do some PREROUTING and/or FORWARD with iptables.

The security risk is limited if this isn't on a public facing network interface and otherwise you want to make sure ingress and egress filtering is done correctly. This to reduce the effects of spoofed traffic.

1

I think the main implication is, that firewall rules (distribution or custom) which allow communication for 127/8 might no longer be effective Iff they fail to specify the ingress interface. If rules are specifically designed for it I would not see a big problem.

It is more of a compatibility and conformance problem if it is actually used on the wire (instead of virtual switch networks).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.