Forwarding is not needed for the loopback interface or am I missing something?

Question

linux

You can not read a brief introduction - it's not interesting.
The machine accesses the Internet through a tunnel and a small subnet is also allocated for it. I need to run multiple test sites on different IPs from this small subnet. I could use the IP on my side of the tunnel for this, but it belongs to the ISP and I can't set a PTR record for it in DNS. I don't have a router. Everything is spinning on one machine, that is, the tunnel is terminated on this machine, I will raise test sites on this machine, so I need to do without a router and terminate the white IP on the loopbac interface.
End of short introduction, read on.

There is an axiom in my head that says that if you want traffic to go between interfaces, be kind, turn on forwarding ... But here's what happens:

1. Forwarding is prohibited by the firewall

test@server:~$ sudo ip6tables -L -v -n
...

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

...

2. Forwarding is disabled by the kernel

net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.eth0.forwarding = 0
net.ipv6.conf.eth0.mc_forwarding = 0
net.ipv6.conf.he-ipv6.forwarding = 0
net.ipv6.conf.he-ipv6.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.sit0.forwarding = 0
net.ipv6.conf.sit0.mc_forwarding = 0
net.ipv6.conf.vlan2017.forwarding = 0
net.ipv6.conf.vlan2017.mc_forwarding = 0
net.ipv6.conf.vlan24.forwarding = 0
net.ipv6.conf.vlan24.mc_forwarding = 0

3. At the same time, I do this

sudo ip -6 a a 2001:470:26:10b::1/128 dev lo
sudo ip -6 a a 2001:470:26:10b::2/128 dev lo
sudo ip -6 a a 2001:470:26:10b::3/128 dev lo

4. It turns out like this

test@server:~$ sudo ip -6 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 
    inet6 2001:470:26:10b::1/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 2001:470:26:10b::3/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 2001:470:26:10b::2/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host

5. Ping Google

test@server:~$ ping6 ipv6.google.com -I 2001:470:26:10b::3
PING ipv6.google.com(li-in-x65.1e100.net) from 2001:470:26:10b::3 : 56 data bytes
64 bytes from li-in-x65.1e100.net: icmp_seq=1 ttl=53 time=109 ms
64 bytes from li-in-x65.1e100.net: icmp_seq=2 ttl=53 time=109 ms
64 bytes from li-in-x65.1e100.net: icmp_seq=3 ttl=53 time=108 ms
^C
--- ipv6.google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 108.460/109.112/109.549/0.541 ms
test@server:~$

6. I see in tcpdump

test@server:~$ sudo tcpdump -n -i he-ipv6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on he-ipv6, link-type RAW (Raw IP), capture size 262144 bytes
20:13:17.031669 IP6 2001:470:26:10b::3 > 2a00:1450:4010:c05::65: ICMP6, echo request, seq 1, length 64
20:13:17.141108 IP6 2a00:1450:4010:c05::65 > 2001:470:26:10b::3: ICMP6, echo reply, seq 1, length 64
20:13:18.033168 IP6 2001:470:26:10b::3 > 2a00:1450:4010:c05::65: ICMP6, echo request, seq 2, length 64
20:13:18.142421 IP6 2a00:1450:4010:c05::65 > 2001:470:26:10b::3: ICMP6, echo reply, seq 2, length 64
20:13:19.034583 IP6 2001:470:26:10b::3 > 2a00:1450:4010:c05::65: ICMP6, echo request, seq 3, length 64
20:13:19.142983 IP6 2a00:1450:4010:c05::65 > 2001:470:26:10b::3: ICMP6, echo reply, seq 3, length 64

Forwarding is not needed for lo or am I missing something?

Answer 1

the FORWARD chain works when from interface to interface, but not the traffic that is generated by the host itself (also forwarding in the kernel)