1

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to connect to an nginx/apache run server on that IP regardless of interface they are connecting through (i.e. en or wl).

auto lo
iface lo inet loopback
     post-up /sbin/ip addr add 192.168.1.200/32 dev lo

The firewall has port forwarding to this IP (192.168.1.200) for ports 40 and 443.

The servers is on the small office LAN which handles sensitive data and a couple of workstations. Our key risks are:

  1. Motivated hacker compromising sensitive data stored on a separate Samba server on the same LAN;
  2. Ransomware attacks.

QUESTION: is this IP binding would be less safe in comparison to using a regular static IP address assignment to a single adapter (rather than to localhost), or they are indistinguishable? Any other advice regarding the use of this approach - bad/good/neutral?

2
  • I've never heard of someone doing this before... I guess if it works, it works... Jun 24, 2020 at 4:05
  • Although it does work, is it safe thought? Or does it open a hole to localhost (whatever this may mean)?
    – afora377
    Jun 25, 2020 at 6:12

3 Answers 3

2

I see a number of answers here about the use of binding IP addresses to loopback interfaces. To be clear, this is not uncommon. It's actually something that is done quite often, for example to create a virtual IP address floating that can move (automatically or manually) from one machine to another with a high availability protocol. The loopback interface is always available on any device, which makes it a good interface to bind the address to.

Also, binding IP addresses to loopback interfaces is often used when a device has multiple network connections, and you don't care about which interface is used to reach the device, you just want to communicate with the specific device regardless of the way it's reached. This is used for example when a machine is using a routing protocol like OSPF and BGP and does dynamic routing.

Now back to your question: is this a good thing security wise? I don't think that in the situation you're describing this offers any real benefit to just adding the IP address to a physical interface and adding proper firewall rules there. In fact, you could argue that the added complexity increases the chances of someone forgetting to apply the rules correctly. Also, if multiple interfaces are available on the device, you need to apply the firewall filters on all interfaces. Personally, I wouldn't use a setup like this if your only goal would be to increase security. Everything you're doing there can be done with a nearly identical firewall filter on the physical interface.

2
  • Thank you. Can you recommend a better way to "fuse" two interfaces under a single IP address as described in the OP?
    – afora377
    Mar 23, 2021 at 22:38
  • You could use a software bridge on Linux (for example openvswitch), however, how to implement that would be a question for perhaps Server Fault or unix.stackexchange.com, it's not a question about information security.
    – Teun Vink
    Mar 23, 2021 at 22:41
0

While I can't think of a reason to use such a configuration, I also can't think of any security issues with it. As long as you intend to make the services available to all attached networks and publicly as you mentioned, there shouldn't be an issue.

Regardless of the configuration, you may benefit from a host-based firewall to ensure only the intended services are available.

0

the loopback interface is supposed to be reserved by the IP protocol, as well as the 127.0.0.1 IP address, if you change the system's loopback address, this may break something else, now or in the future. those are reserved for a reason.

I don't think it is a good idea to change such basic config to solve a common problem, it may be healthier for the system to have the regular configurations with two interfaces (wl and eth) with their own IP address and a server assigned to each.

Besides this, you may experience some problems troubleshooting if you can't distinguish the wireless from the ethernet communications in the logs.

2
  • Do you have a security reason? Right now, this answer is only a OS-level answer.
    – schroeder
    Jun 25, 2020 at 14:10
  • I know, the reasons are more on the stability side than in the security side. But thinking of the safety... this hack may make the system more fragile, but still have no proof of it. Jun 26, 2020 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.