sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1
What are the security implications of
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The documentation for this options shows the following:
route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/8 for local routing purposes. default FALSE
In essence it tells the kernel not to treat local routing for as a danger and refuse it. As long as net.ipv4.ip_forward is 0 you shouldn't need to change route_localnet. In most cases you only need this when you do some PREROUTING and/or FORWARD with iptables.
The security risk is limited if this isn't on a public facing network interface and otherwise you want to make sure ingress and egress filtering is done correctly. This to reduce the effects of spoofed traffic.
I think the main implication is, that firewall rules (distribution or custom) which allow communication for 127/8 might no longer be effective Iff they fail to specify the ingress interface. If rules are specifically designed for it I would not see a big problem.
It is more of a compatibility and conformance problem if it is actually used on the wire (instead of virtual switch networks).