Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using lxc to host some services. I wish to expose one of these services to the outside world.

I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge for the containers/guests) and an OUTPUT rule for traffic from the host itself.

With these rules I can use the hosts IP (10.234.13.185) with my chosen port (4050) to reach the guest/container (192.168.3.54:61616). This works from the outside world, the host and other guests.

However, I cannot get it to work from the guest with the service (192.168.3.54).

I notice that traffic comes into the host on port 4050 and under normal conditions ends up on the guest at port 61616. However if traffic is coming from the guest it still hits the hosts port 4050 but doesn't get routed to 61616 but sticks to 4050 instead.

I've done an ngrep and from other clients I see (using telnet):

  • $host: ngrep -p 4050: 10.234.13.185:4050 -> $client_ip [AR]
  • $host: ngrep -p 61616: $client_ip -> 192.168.3.54 [S] * 2, 192.168.3.54:61616 -> $client_ip [AR]
  • $guest: ngrep -p 61616: 192.168.3.54:61616 -> $client_ip [AR]
  • $guest: ngrep -p 4050: nothing

However, when I repeat but telnet from the guest itself I see:

  • $host: ngrep -p 4050: 192.168.3.54:** -> 10.234.13.185:4050 [S] (repeatedly)
  • $host: ngrep -p 61616: 192.168.3.54:** -> 192.168.3.54:61616 [S] (only once)
  • $guest: ngrep -p 61616: nothing
  • $guest: ngrep -p 4050: 192.168.3.54:** -> 10.234.13.185:4050 [S] (repeatedly)

I'm presuming a missing rule (possibly a POSTROUTING rule for the source?).

Here is a copy of my iptables-save

*nat
:PREROUTING ACCEPT [36:2286]
:INPUT ACCEPT [5:426]
:OUTPUT ACCEPT [25:1610]
:POSTROUTING ACCEPT [8:504]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 4050 -j DNAT --to-destination 192.168.3.54:61616
-A PREROUTING -i br0  -p tcp -m tcp --dport 4050 -j DNAT --to-destination 192.168.3.54:61616
-A OUTPUT -p tcp -m tcp --dport 4050 -j DNAT --to-destination 192.168.3.54:61616
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

Any help greatly appreciated.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.