mjhjmtu

I have a laptop with a somewhat weird networking setup: in order to be able to forward any Internet access from my VMs and containers to whatever default route my laptop happens to have (which could be wlan0, eth0 or ppp0), I've set the usual sysctl net.ipv4.ip_forward=1 and the following in my /etc/network/interfaces:

auto lxcbr0

iface lxcbr0 inet static
 address 192.168.56.1
 netmask 255.255.255.0
 bridge_ports none
 bridge_fd 0
 bridge_maxwait 0
 # XXX: no --out-interface
 up iptables -t nat -A POSTROUTING -j MASQUERADE
 down iptables -t nat -D POSTROUTING -j MASQUERADE

I use NetworkManager to obtain my Internet connection. So far, this worked normally, until I tried to launch fossil ui and it turned out that connecting to 127.0.0.1 in this setup results in client address being from a different subnet.

For example, the following Perl script:

#!/usr/bin/perl
use 5.020;
use IO::Socket::INET;
say IO::Socket::INET::->new(
 Proto=>"tcp", Listen=>0,
 LocalAddr=>"127.0.0.1:8080",
 ReuseAddr=>1, ReusePort=>1,
)->accept->peerhost;

would normally print 127.0.0.1 if I use nc 127.0.0.1 8080 to connect to it (and it does so on my other machines), but on this laptop it prints 192.168.1.11 (which is indeed the address of wlan0 where my current default route resides).

I tried to add a special route to 127.0.0.0/8 via lo, but it didn't change anything.

How do I make localhost connections behave like they're actually from localhost?

Adding the ! --out-interface lo to the NAT firewall rule did the trick: now lo access is governed by the usual laws and is not subject to any masquerading (as it shouldn't).