I found some articles related to this, but they were not sufficient for me. I want to know how the localhost works and why is it the same on many different machines?
How does the localhost block the access to the website when we use it in the host file to block the website?
I won't talk about the Windows case here, because it's a bit different, but let's say this: In every* Unix-like operating system, you have two network devices:
The first one is purely "virtual". It's like an Ethernet plug that you can't see. The second one has to do with the Ethernet plug in your computer.
What does the loopback interface do? Every traffic that you send to loopback will come back.
Like your Ethernet device gets an IP address (for example 192.168.1.20), the loopback device will also have an IP address, namely 127.0.0.1. To make it easier, you can access it over localhost too.
If you have a look at a typical Unix /etc/hosts file, you will see that 127.0.0.1 is mapped to "localhost". So whenever you type "localhost", your computer will know to call 127.0.0.1.
And this is the reason why you can "block" applications. Let's say you don't want your computer to send data to Microsoft. Then you could simply redirect every request to microsoft.com to 127.0.0.1 instead. Every attempt to contact microsoft.com would result in a failure.
* every system that actually has a hardware Ethernet port
Internet Protocol (IP) addresses fall in one of four basic categories.
By agreement, 127.0.0.1 is one of those addresses that fall in the last of those categories.
As humans, we don't tend to remember IP numbers very well, but we have no problem remembering names like superuser.com, www.google.com, and other similar names. When the internet was small (very small), humans shared a "hosts" file to other people on the internet so they didn't have to remember numbers. That hosts file contained pairs of an IP address and one or more host names. When someone tried to access a host by its name, the computer software knew enough to go look it up in the hosts file. The internet has grown so much since then that we now use a domain name system (DNS) in order to resolve names to IP numbers in addition to using the old style hosts file. Most computers are set up to look up names in the hosts file first, then in DNS if that fails.
Now that you have the background, here's how it works (usually):
When you add this entry to your hosts file, any time your computer tries too look up www.foo.com, it will try to reach that site on the IP address 127.0.0.1 because you told it that is the Internet Address for www.foo.com. Remember that 127.0.0.1 will allow a computer to talk to itself so attempting to go to 127.0.0.1 in your browser will try to contact a web server on your computer. If you had put in 2.3.4.5 instead of 127.0.0.1, it would have tried to contact the computer at address 2.3.4.5 when opening up www.foo.com.
127.0.0.1 localhost
127.0.0.1 www.foo.com
127.0.0.1 foo.com
The bad thing about using the hosts file for things like this is once you add an entry to the hosts file, you are assuming responsibility for keeping that information up-to-date. If you don't put the entry in your hosts file, your computer will try to use DNS to look up the IP address, then use that IP address to contact the server.
The good thing about it is if you never want to allow anyone to talk to www.foo.com by the host name on your computer only, adding the entry to your hosts file may (keyword - may) prevent that from happening. If the goal is to prevent ever reaching a particular site by any means (not just by host name), there are other better and more reliable ways to prevent that from happening like properly using a firewall.
Localhost or 127.0.0.1 is simply a built in 'name' for your local computer.
That is, 127.0.0.1 is called a "loopback", because it is merely a pointer that points back to your machine. It's a reserved IP Address that can also be written as localhost by definition.
The purpose for this is to allow one to talk to one's computer by sending a signal outwards and then looping this back so that the signal is also read by your same computer.
Say you're running a server on your machine-- to access it, you have to send a request to the server (send a packet to 127.0.0.1), and your server has to read it (your system loops back the packet to your local system on 127.0.0.1 which is then read by your server software).
I discovered a presentation at The TCP/IP Guide that struck me as very illuminating:
Normally, when a TCP/IP application wants to send information, that information travels down the protocol layers to IP where it is encapsulated in an IP datagram. That datagram then passes down to the data link layer of the device’s physical network for transmission to the next hop, on the way to the IP destination.
However, one special range of addresses is set aside for loopback functionality. This is the range 127.0.0.0 to 127.255.255.255. IP datagrams sent by a host to a 127.x.x.x loopback address are not passed down to the data link layer for transmission. Instead, they “loop back” to the source device at the IP level. In essence, this represents a “short-circuiting” of the normal protocol stack; data is sent by a device’s layer three IP implementation and then immediately received by it.
Also, Rutgers has a Networking course that includes this illustration of normal, inter-host communication,
and this one of the loopback data flow:
For the second part of your question, if you put the hostname of a web site in your hosts file with the address 127.0.0.1 it means that when you type the address into your browser instead of using DNS to find the correct address it finds it in your hosts file first resolves it to localhost and instead of going to the website's address just starts talking to your machine which causes the website to fail to load.
