Index: trunk/src/VBox/Main/xml/Settings.cpp
===================================================================
--- trunk/src/VBox/Main/xml/Settings.cpp	(revision 91416)
+++ trunk/src/VBox/Main/xml/Settings.cpp	(revision 92133)
@@ -1472,4 +1472,15 @@
     return m->fFileExists;
 }
+
+/**
+ * Returns the settings file version
+ *
+ * @returns Settings file version enum.
+ */
+SettingsVersion_T ConfigFileBase::getSettingsVersion()
+{
+    return m->sv;
+}
+
 
 /**
@@ -3030,5 +3041,6 @@
     fAliasLog(false),
     fAliasProxyOnly(false),
-    fAliasUseSamePorts(false)
+    fAliasUseSamePorts(false),
+    fLocalhostReachable(true) /* Historically this value is true. */
 {
 }
@@ -3061,8 +3073,24 @@
 
 /**
+ * Check whether the localhost-reachable setting is the default for the given settings version.
+ */
+bool NAT::areLocalhostReachableDefaultSettings(SettingsVersion_T sv) const
+{
+    return    (   fLocalhostReachable
+                && sv < SettingsVersion_v1_19)
+           || (   !fLocalhostReachable
+                && sv >= SettingsVersion_v1_19);
+}
+
+/**
  * Check if all settings have default values.
  */
-bool NAT::areDefaultSettings() const
-{
+bool NAT::areDefaultSettings(SettingsVersion_T sv) const
+{
+    /*
+     * Before settings version 1.19 localhost was reachable by default
+     * when using NAT which was changed with version 1.19+, see @bugref{9896}
+     * for more information.
+     */
     return strNetwork.isEmpty()
         && strBindIP.isEmpty()
@@ -3075,5 +3103,6 @@
         && areAliasDefaultSettings()
         && areTFTPDefaultSettings()
-        && mapRules.size() == 0;
+        && mapRules.size() == 0
+        && areLocalhostReachableDefaultSettings(sv);
 }
 
@@ -3102,4 +3131,5 @@
             && fAliasProxyOnly     == n.fAliasProxyOnly
             && fAliasUseSamePorts  == n.fAliasUseSamePorts
+            && fLocalhostReachable == n.fLocalhostReachable
             && mapRules            == n.mapRules);
 }
@@ -3145,5 +3175,5 @@
         && enmPromiscModePolicy == NetworkAdapterPromiscModePolicy_Deny
         && mode == NetworkAttachmentType_Null
-        && nat.areDefaultSettings()
+        && nat.areDefaultSettings(sv)
         && strBridgedName.isEmpty()
         && strInternalNetworkName.isEmpty()
@@ -3162,7 +3192,7 @@
  * Special check if settings of the non-current attachment type have default values.
  */
-bool NetworkAdapter::areDisabledDefaultSettings() const
-{
-    return (mode != NetworkAttachmentType_NAT ? nat.areDefaultSettings() : true)
+bool NetworkAdapter::areDisabledDefaultSettings(SettingsVersion_T sv) const
+{
+    return (mode != NetworkAttachmentType_NAT ? nat.areDefaultSettings(sv) : true)
         && (mode != NetworkAttachmentType_Bridged ? strBridgedName.isEmpty() : true)
         && (mode != NetworkAttachmentType_Internal ? strInternalNetworkName.isEmpty() : true)
@@ -4177,4 +4207,5 @@
         elmMode.getAttributeValue("tcprcv", nic.nat.u32TcpRcv);
         elmMode.getAttributeValue("tcpsnd", nic.nat.u32TcpSnd);
+        elmMode.getAttributeValue("localhost-reachable", nic.nat.fLocalhostReachable);
         const xml::ElementNode *pelmDNS;
         if ((pelmDNS = elmMode.findChildElement("DNS")))
@@ -6863,5 +6894,5 @@
                 {
                     /* m->sv >= SettingsVersion_v1_10 */
-                    if (!nic.areDisabledDefaultSettings())
+                    if (!nic.areDisabledDefaultSettings(m->sv))
                     {
                         xml::ElementNode *pelmDisabledNode = pelmAdapter->createChild("DisabledModes");
@@ -7251,9 +7282,9 @@
             // For the currently active network attachment type we have to
             // generate the tag, otherwise the attachment type is lost.
-            if (fEnabled || !nic.nat.areDefaultSettings())
+            if (fEnabled || !nic.nat.areDefaultSettings(m->sv))
             {
                 xml::ElementNode *pelmNAT = elmParent.createChild("NAT");
 
-                if (!nic.nat.areDefaultSettings())
+                if (!nic.nat.areDefaultSettings(m->sv))
                 {
                     if (nic.nat.strNetwork.length())
@@ -7271,4 +7302,6 @@
                     if (nic.nat.u32TcpSnd)
                         pelmNAT->setAttribute("tcpsnd", nic.nat.u32TcpSnd);
+                    if (!nic.nat.areLocalhostReachableDefaultSettings(m->sv))
+                        pelmNAT->setAttribute("localhost-reachable", nic.nat.fLocalhostReachable);
                     if (!nic.nat.areDNSDefaultSettings())
                     {
@@ -7962,4 +7995,18 @@
             return;
         }
+
+        NetworkAdaptersList::const_iterator netit;
+        for (netit = hardwareMachine.llNetworkAdapters.begin();
+             netit != hardwareMachine.llNetworkAdapters.end();
+             ++netit)
+        {
+            if (   netit->fEnabled
+                && netit->mode == NetworkAttachmentType_NAT
+                && !netit->nat.fLocalhostReachable)
+            {
+                m->sv = SettingsVersion_v1_19;
+                break;
+            }
+        }
     }
 
