Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces
Forces net.ipv4.conf.all.route_localnet to 0 so the kernel refuses to route external traffic to or from the 127.0.0.0/8 loopback range on every IPv4 interface.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
By default the kernel treats the 127.0.0.0/8 loopback range as non-routable (martian). Setting net.ipv4.conf.all.route_localnet=1 lifts that protection and lets the kernel route packets to and from 127.0.0.0/8 on real interfaces. An attacker on the local segment could then reach services bound to 127.0.0.1, databases, admin sockets, metrics endpoints, that the operator deliberately exposed only to localhost. Keeping it at 0 preserves the loopback boundary as a trust boundary.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.all.route_localnet via the kernel (InSpec kernel_parameter, equivalent to sysctl), not the text of /etc/sysctl.conf or any drop-in. A file under /etc/sysctl.d/ can declare 0 while the running kernel still holds 1 because a later drop-in, a boot-time service, or a manual sysctl -w overrode it. Auditing the effective parameter catches that drift; reading a file would not.
describe kernel_parameter('net.ipv4.conf.all.route_localnet') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.route_localnet[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.route_localnet. Expected output:
net.ipv4.conf.all.route_localnet = 0
Inspect & investigate
This is a kernel tunable, so there is no dedicated event log. Inspect its state with sysctl net.ipv4.conf.all.route_localnet, list the per-interface values with sysctl -a | grep route_localnet, and confirm the persisted source with sysctl --system 2>&1 | grep route_localnet to see which drop-in last set it.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.route_localnet to 0, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.route_localnet |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting this to 0 is the kernel default and is safe for virtually all hosts. The only systems that legitimately need route_localnet=1 are those running NAT/redirect rules that forward traffic to a service on 127.0.0.1 (some load-balancer or transparent-proxy setups, certain iptables/nftables DNAT-to-loopback designs). Before applying, confirm no firewall rule depends on loopback routing (iptables-save | grep 127.0.0); if one does, that service would stop receiving traffic. There is no risk of losing remote access from this change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.