127.0.0.0/8 Loopback Address Explained

Quick answer: 127.0.0.0/8 is the IPv4 loopback range. Traffic sent to any address from 127.0.0.0 through 127.255.255.255 is returned to the same device by its operating system and must not appear on an external network. 127.0.0.1 is simply its best-known address.

What does 127.0.0.0/8 mean?

The /8 prefix fixes the first eight bits, so every IPv4 address beginning with 127 belongs to this special-use block. It contains 16,777,216 addresses, but they are not a pool for assigning devices on a home, office, or cloud network.

When an application connects to 127.0.0.1, the operating system processes the packet inside its own networking stack. The packet does not pass through Wi-Fi, Ethernet, the router, or the internet. The same loopback behavior normally applies to addresses such as 127.0.0.2 and 127.10.20.30, although software commonly assumes 127.0.0.1 unless configured otherwise.

Why is an entire /8 reserved for loopback?

The choice comes from the early classful design of IPv4. Network number 127 was assigned the loopback function when a /8 represented a full Class A network. Modern CIDR could express a much smaller block, but changing the reservation now would break decades of operating-system, router, firewall, and application behavior.

The block may look wasteful, but it is part of IPv4’s established protocol contract. Reusing portions of it publicly would create ambiguous routing and security problems. The current IANA IPv4 Special-Purpose Address Registry therefore continues to list the complete 127.0.0.0/8 range as loopback and not globally reachable.

Loopback, private, and public IP addresses

These address types solve different problems:

A private IP can travel between devices on a local network. A loopback IP cannot reach even the router: on every device, 127.0.0.1 always refers back to that same device. See the private IP range overview for addresses intended for real internal networks.

Is 127.0.0.1 the same as localhost?

They usually lead to the same place, but they are not the same kind of identifier:

• 127.0.0.1 is a numeric IPv4 loopback address.
• localhost is a special-use hostname that normally resolves to an IPv4 or IPv6 loopback address.
• ::1 is the IPv6 loopback address.

According to RFC 6761, name-resolution software should recognize localhost as special and return a loopback address rather than relying on public DNS. Depending on the operating system and application, localhost may prefer ::1 over 127.0.0.1. That difference explains why a service can occasionally work at one URL but not the other.

http://localhost:3000    # Resolved to an IPv4 or IPv6 loopback address
http://127.0.0.1:3000    # Explicit IPv4 loopback address
http://[::1]:3000        # Explicit IPv6 loopback address

All three URLs request port 3000 on the current device, but they may use different address families.

What does the hosts file do?

Operating systems commonly include loopback mappings in a local hosts file. Typical entries look like this:

127.0.0.1 localhost
::1       localhost

The common hosts file locations are:

• Windows: C:\Windows\System32\drivers\etc\hosts
• macOS and Linux: /etc/hosts

The hosts file is checked locally and can map other development names as well. However, modern resolvers and applications may treat localhost specially even without this file. Edit it only when necessary, keep a backup, and avoid downloading replacement hosts files from untrusted sources.

How does IPv6 loopback work?

IPv6 uses one loopback address, ::1/128, rather than reserving a block comparable to IPv4’s /8. It has the same basic meaning: send the traffic back to this device without putting it on a physical network.

An application may listen only on IPv4, only on IPv6, or on both. If localhost resolves to ::1 but the service listens only on 127.0.0.1, the hostname request can fail while the numeric IPv4 URL succeeds. The reverse is also possible. Read IPv4 vs IPv6 for the wider protocol differences.

Why do local services bind to loopback?

Development servers, admin panels, databases, caches, and local proxies often listen on a loopback address so only programs on the same machine can connect. Some MySQL, PostgreSQL, and Redis installations use loopback-oriented defaults or recommend them for local-only deployments.

The listening address matters:

Binding to 0.0.0.0 is useful when intentionally sharing a development server with another device or running it in a container, but it expands the exposure surface. It is not a substitute for firewall rules, authentication, or encrypted connections.

How to fix “localhost refused to connect”

“Connection refused” usually means the operating system reached the target address but found no service accepting connections on that port. Check these items in order:

1. Confirm that the service is running. A successful build does not necessarily start a web server or database.
2. Check the port. localhost:3000 and localhost:4321 are different destinations.
3. Check the listening address. Compare localhost, 127.0.0.1, and [::1] to detect an IPv4/IPv6 mismatch.
4. Inspect the application log. A port conflict, missing environment variable, or startup error may have stopped the service.
5. Consider containers and virtual machines. Their localhost refers to the container or virtual machine itself, not automatically to the host computer.
6. Check proxies and firewalls. Local proxy settings, security software, and firewall rules can still affect a loopback service.

Useful checks include:

# Test the HTTP endpoint
curl -v http://127.0.0.1:3000

# macOS: show a process listening on TCP port 3000
lsof -nP -iTCP:3000 -sTCP:LISTEN

# Linux
ss -ltnp | grep ':3000'

# Windows Command Prompt
netstat -ano | findstr :3000

If nothing is listening, start the service or correct its port. If it listens on the wrong address family, update its bind configuration or use the matching loopback URL.

Is loopback automatically secure?

Loopback is not absolutely secure. Its main advantage is network-scope isolation: devices on the internet or local network cannot connect directly to your 127.0.0.1 over Ethernet or Wi-Fi. It is like closing the outside door of a building; outsiders are kept out, but everyone already inside is not automatically trustworthy.

Malware, a risky browser extension, another local user, or a vulnerable application on the same computer may still connect as a local client. An unauthenticated database or development tool may not be able to distinguish those requests from legitimate ones. Listening on loopback reduces external exposure, but it does not replace authentication, authorization, request validation, secret protection, or security updates.

Loopback address FAQ

Related reading

Continue with What Is My Local IP Address?, compare loopback with the private IP ranges, or learn the familiar single-address form in What Is 127.0.0.1?.