Loopback addresses

The loopback range is 127.0.0.0/8 — 127.0.0.0 to 127.255.255.255, a 255.0.0.0 mask, 16,777,216 addresses. 127.0.0.1, conventionally named localhost, is the one almost everybody uses.

RFC 5735 reserves the range for internal host loopback communication and states that packets addressed to it must never appear on any network.

Loopback is per host, not per network

Loopback operates at the host level. Every device has its own loopback interface, and every one of them uses the same range. A router at 192.168.1.1 and the two workstations behind it each answer to 127.0.0.1 — on themselves, and only on themselves.

Router:      192.168.1.1   (plus its own 127.0.0.1)
Workstation: 192.168.1.10  (plus its own 127.0.0.1)
Workstation: 192.168.1.11  (plus its own 127.0.0.1)

The same holds in a VPC: a server at 10.0.1.100 and a workstation at 10.0.2.50 both have a private loopback that nothing else can reach.

Behaviour

• Traffic never leaves the machine.
• No physical network interface is required.
• The interface is available even with no network connectivity at all.

That makes loopback useful for testing the local TCP/IP stack, for diagnostics, and for processes on one host talking to each other:

ping 127.0.0.1          # test the local TCP/IP stack
curl http://127.0.0.1   # connect to a local web server
ssh 127.0.0.1           # SSH to the local machine

In AWS

• EC2 instances use 127.0.0.1 for services that should not be reachable from the network.
• Containers use it for process-to-process traffic inside the container’s own network namespace; note that in a container, 127.0.0.1 is the container, not the host.
• Binding a database or an application server to 127.0.0.1 rather than 0.0.0.0 is a common and effective way of ensuring it is only reachable through a local proxy.

A service bound to loopback cannot be reached by a load balancer health check or by any other instance, no matter how the security groups are set. That is usually the intent, and occasionally the bug.