src/pkg/Makefile                    | 15 ++++++++++-----
 src/pkg/netchan/netchan_test.go     |  6 +++---
 src/pkg/rpc/server_test.go          |  4 ++--
 src/pkg/websocket/websocket_test.go |  2 +-

diff --git a/src/pkg/Makefile b/src/pkg/Makefile
index 005c957046ba67f416a444a7f178bd732084edd9..1bbb91bfeba9b1d12a1d33a22e83a1ea07c7d21a 100644
--- a/src/pkg/Makefile
+++ b/src/pkg/Makefile
@@ -146,11 +146,10 @@
 NOBENCH=\
 	container/vector\
 
-TEST=\
-	$(filter-out $(NOTEST),$(DIRS))
-
-BENCH=\
-	$(filter-out $(NOBENCH),$(TEST))
+# Disable tests that depend on an external network.
+ifeq ($(DISABLE_NET_TESTS),1)
+NOTEST+=http net
+endif
 
 # Disable tests that NaCl cannot run yet.
 ifeq ($(GOOS),nacl)
@@ -171,6 +170,12 @@ NOTEST+=syslog       # no network
 NOTEST+=time         # no syscall.Kill, syscall.SIGCHLD for sleep tests
 NOTEST+=websocket    # no network
 endif
+
+TEST=\
+	$(filter-out $(NOTEST),$(DIRS))
+
+BENCH=\
+	$(filter-out $(NOBENCH),$(TEST))
 
 clean.dirs: $(addsuffix .clean, $(DIRS))
 install.dirs: $(addsuffix .install, $(DIRS))
diff --git a/src/pkg/netchan/netchan_test.go b/src/pkg/netchan/netchan_test.go
index ca3f4d4c79883ca86b396b59b360a1cbcefaa391..01fc0f32726811ffa799359794af61e7ccd0194c 100644
--- a/src/pkg/netchan/netchan_test.go
+++ b/src/pkg/netchan/netchan_test.go
@@ -72,7 +72,7 @@ 	}
 }
 
 func TestExportSendImportReceive(t *testing.T) {
-	exp, err := NewExporter("tcp", ":0")
+	exp, err := NewExporter("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal("new exporter:", err)
 	}
@@ -85,7 +85,7 @@ 	importReceive(imp, t)
 }
 
 func TestExportReceiveImportSend(t *testing.T) {
-	exp, err := NewExporter("tcp", ":0")
+	exp, err := NewExporter("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal("new exporter:", err)
 	}
@@ -98,7 +98,7 @@ 	exportReceive(exp, t)
 }
 
 func TestClosingExportSendImportReceive(t *testing.T) {
-	exp, err := NewExporter("tcp", ":0")
+	exp, err := NewExporter("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal("new exporter:", err)
 	}
diff --git a/src/pkg/rpc/server_test.go b/src/pkg/rpc/server_test.go
index 3196891d25d6d8ee6b87a407b004590e3980bb50..edf35e6c9f27eb58227f42efa2bf1fa9cbfe56d8 100644
--- a/src/pkg/rpc/server_test.go
+++ b/src/pkg/rpc/server_test.go
@@ -55,7 +55,7 @@
 func startServer() {
 	Register(new(Arith))
 
-	l, e := net.Listen("tcp", ":0") // any available address
+	l, e := net.Listen("tcp", "127.0.0.1:0") // any available address
 	if e != nil {
 		log.Exitf("net.Listen tcp :0: %v", e)
 	}
@@ -64,7 +64,7 @@ 	log.Stderr("Test RPC server listening on ", serverAddr)
 	go Accept(l)
 
 	HandleHTTP()
-	l, e = net.Listen("tcp", ":0") // any available address
+	l, e = net.Listen("tcp", "127.0.0.1:0") // any available address
 	if e != nil {
 		log.Stderrf("net.Listen tcp :0: %v", e)
 		os.Exit(1)
diff --git a/src/pkg/websocket/websocket_test.go b/src/pkg/websocket/websocket_test.go
index 0762fca699136dad6db73a66b4505e0d928eae80..df7e9f4dae944f3e9cbbbd7c49bdca834234e213 100644
--- a/src/pkg/websocket/websocket_test.go
+++ b/src/pkg/websocket/websocket_test.go
@@ -20,7 +20,7 @@
 func echoServer(ws *Conn) { io.Copy(ws, ws) }
 
 func startServer() {
-	l, e := net.Listen("tcp", ":0") // any available address
+	l, e := net.Listen("tcp", "127.0.0.1:0") // any available address
 	if e != nil {
 		log.Exitf("net.Listen tcp :0 %v", e)
 	}