Index: /trunk/src/VBox/Devices/Network/DrvNAT.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/DrvNAT.cpp	(revision 92093)
@@ -1599,4 +1599,5 @@
                                   "|ICMPCacheLimit"
                                   "|SoMaxConnection"
+                                  "|LocalhostReachable"
 //#ifdef VBOX_WITH_DNSMAPPING_IN_HOSTRESOLVER
                                   "|HostResolverMappings"
@@ -1626,4 +1627,6 @@
     int iIcmpCacheLimit = 100;
     GET_S32(rc, pDrvIns, pCfg, "ICMPCacheLimit", iIcmpCacheLimit);
+    bool fLocalhostReachable = false;
+    GET_BOOL(rc, pDrvIns, pCfg, "LocalhostReachable", fLocalhostReachable);
 
     i32AliasMode |= (i32MainAliasMode & 0x1 ? 0x1 : 0);
@@ -1666,5 +1669,5 @@
     rc = slirp_init(&pThis->pNATState, RT_H2N_U32(Network.u), Netmask.u,
                     fPassDomain, !!fUseHostResolver, i32AliasMode,
-                    iIcmpCacheLimit, pThis);
+                    iIcmpCacheLimit, fLocalhostReachable, pThis);
     if (RT_SUCCESS(rc))
     {
Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 92093)
@@ -481,4 +481,9 @@
                 || CTL_CHECK(dst, CTL_TFTP))
             {
+                /* Don't reply to ping requests for the hosts loopback interface if it is disabled. */
+                if (   CTL_CHECK(dst, CTL_ALIAS)
+                    && !pData->fLocalhostReachable)
+                    goto done;
+
                 uint8_t echo_reply = ICMP_ECHOREPLY;
                 m_copyback(pData, m, hlen + RT_OFFSETOF(struct icmp, icmp_type),
Index: /trunk/src/VBox/Devices/Network/slirp/libslirp.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/libslirp.h	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/libslirp.h	(revision 92093)
@@ -47,5 +47,5 @@
 #endif
 
-int slirp_init(PNATState *, uint32_t, uint32_t, bool, bool, int, int, void *);
+int slirp_init(PNATState *, uint32_t, uint32_t, bool, bool, int, int, bool, void *);
 void slirp_register_statistics(PNATState pData, PPDMDRVINS pDrvIns);
 void slirp_deregister_statistics(PNATState pData, PPDMDRVINS pDrvIns);
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 92093)
@@ -299,5 +299,5 @@
 int slirp_init(PNATState *ppData, uint32_t u32NetAddr, uint32_t u32Netmask,
                bool fPassDomain, bool fUseHostResolver, int i32AliasMode,
-               int iIcmpCacheLimit, void *pvUser)
+               int iIcmpCacheLimit, bool fLocalhostReachable, void *pvUser)
 {
     int rc;
@@ -316,4 +316,5 @@
     pData->fUseHostResolver = fUseHostResolver;
     pData->fUseHostResolverPermanent = fUseHostResolver;
+    pData->fLocalhostReachable = fLocalhostReachable;
     pData->pvUser = pvUser;
     pData->netmask = u32Netmask;
@@ -1353,4 +1354,10 @@
                 || CTL_CHECK(ip4TargetAddress, CTL_TFTP))
             {
+#if 0 /* Dropping ARP requests destined for CTL_ALIAS breaks all outgoing traffic completely, so don't do that... */
+                /* Don't reply to ARP requests for the hosts loopback interface if it is disabled. */
+                if (   CTL_CHECK(ip4TargetAddress, CTL_ALIAS)
+                    && !pData->fLocalhostReachable)
+                    break;
+#endif
                 slirp_update_guest_addr_guess(pData, *(uint32_t *)pARPHeader->ar_sip, "arp request");
                 arp_output(pData, pEtherHeader->h_source, pARPHeader, ip4TargetAddress);
Index: /trunk/src/VBox/Devices/Network/slirp/slirp_state.h
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp_state.h	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp_state.h	(revision 92093)
@@ -287,4 +287,7 @@
     /* this field control behaviour of DHCP server */
     bool fUseDnsProxy;
+    /** Flag whether the guest can contact services on the host's
+     * loopback interface (127.0.0.1/localhost). */
+    bool fLocalhostReachable;
 
     LIST_HEAD(RT_NOTHING, libalias) instancehead;
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 92093)
@@ -502,4 +502,16 @@
     }
     LogFlowFunc(("(leave) findso: %R[natsock]\n", so));
+
+    /*
+     * Check whether the packet is targeting CTL_ALIAS and drop it if the connection wasn't
+     * initiated by localhost (so == NULL), see @bugref{9896}.
+     */
+    if (   (RT_N2H_U32(ti->ti_dst.s_addr) & ~pData->netmask) == CTL_ALIAS
+        && !pData->fLocalhostReachable
+        && !so)
+    {
+        LogFlowFunc(("Packet for CTL_ALIAS and fLocalhostReachable=false so=NULL -> drop\n"));
+        goto drop;
+    }
 
     /*
Index: /trunk/src/VBox/Devices/Network/slirp/udp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 92092)
+++ /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 92093)
@@ -233,4 +233,12 @@
 
     /*
+     * Drop UDP packets destind for CTL_ALIAS (i.e. the hosts loopback interface)
+     * if it is disabled.
+     */
+    if (   CTL_CHECK(ip->ip_dst.s_addr, CTL_ALIAS)
+        && !pData->fLocalhostReachable)
+        goto done_free_mbuf;
+
+    /*
      * Locate pcb for datagram.
      */
