Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using lxc to host some services. I wish to expose one of these services to the outside world.

I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge for the containers/guests) and an OUTPUT rule for traffic from the host itself.

With these rules I can use the hosts IP ( with my chosen port (4050) to reach the guest/container ( This works from the outside world, the host and other guests.

However, I cannot get it to work from the guest with the service (

I notice that traffic comes into the host on port 4050 and under normal conditions ends up on the guest at port 61616. However if traffic is coming from the guest it still hits the hosts port 4050 but doesn't get routed to 61616 but sticks to 4050 instead.

I've done an ngrep and from other clients I see (using telnet):

  • $host: ngrep -p 4050: -> $client_ip [AR]
  • $host: ngrep -p 61616: $client_ip -> [S] * 2, -> $client_ip [AR]
  • $guest: ngrep -p 61616: -> $client_ip [AR]
  • $guest: ngrep -p 4050: nothing

However, when I repeat but telnet from the guest itself I see:

  • $host: ngrep -p 4050:** -> [S] (repeatedly)
  • $host: ngrep -p 61616:** -> [S] (only once)
  • $guest: ngrep -p 61616: nothing
  • $guest: ngrep -p 4050:** -> [S] (repeatedly)

I'm presuming a missing rule (possibly a POSTROUTING rule for the source?).

Here is a copy of my iptables-save

:OUTPUT ACCEPT [25:1610]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 4050 -j DNAT --to-destination
-A PREROUTING -i br0  -p tcp -m tcp --dport 4050 -j DNAT --to-destination
-A OUTPUT -p tcp -m tcp --dport 4050 -j DNAT --to-destination

Any help greatly appreciated.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.