diff --git a/hack/integration-net.sh b/hack/integration-net.sh
index 14a3b901..85a8f08f 100755
--- a/hack/integration-net.sh
+++ b/hack/integration-net.sh
@@ -19,3 +19,30 @@ if [ "${net}" = "lxc-user-nic" ]; then
 	sudo /usr/lib/$(uname -m)-linux-gnu/lxc/lxc-net start || sudo /etc/init.d/lxc-net start || true
 fi
 $ROOTLESSKIT --net=${net} --copy-up=/etc --copy-up=/run --disable-host-loopback ${flags} -- nslookup example.com
+
+# Test that a server process listening on the host loopback is not accessible from the isolated namespace
+tmp=$(mktemp -d)
+echo "hello host loopback" >${tmp}/index.html
+
+busybox httpd -f -p 127.0.0.1:8080 -h ${tmp} &
+pid=$!
+
+sleep 1
+
+statedir=$(mktemp -d)
+CURL="timeout 3 curl -fsSL http://127.0.0.1:8080"
+if echo "${flags}" | grep -q -- --detach-netns; then
+	# With --detach-netns, the child command runs in the host's network namespace,
+	# so it has to enter the detached network namespace explicitly.
+	CURL="nsenter -n${statedir}/netns ${CURL}"
+fi
+
+if $ROOTLESSKIT --state-dir=${statedir} --net=${net} --copy-up=/etc --copy-up=/run --disable-host-loopback ${flags} -- ${CURL}; then
+	ERROR "the host loopback should not be accessible from the isolated namespace"
+	exit 1
+fi
+
+INFO "the host loopback is not accessible from the isolated namespace, as expected"
+
+kill -9 $pid || true
+rm -rf ${tmp} ${statedir}
diff --git a/pkg/network/pasta/pasta.go b/pkg/network/pasta/pasta.go
index e4411c2f..62f27935 100644
--- a/pkg/network/pasta/pasta.go
+++ b/pkg/network/pasta/pasta.go
@@ -155,7 +155,7 @@ func (d *parentDriver) ConfigureNetwork(childPID int, stateDir, detachedNetNSPat
 		"--dns-forward=" + dns.String(),
 	}
 	if d.disableHostLoopback {
-		opts = append(opts, "--no-map-gw")
+		opts = append(opts, "--no-map-gw", "--tcp-ns=none", "--udp-ns=none")
 	}
 	if !d.enableIPv6 {
 		opts = append(opts, "--ipv4-only")