Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a host machine(A) with lxc-container(B). A's local ip address is and public ip, let's say B's local ip address is

I need to be forwarded to and I created the following rules for that:

iptables -t nat -I PREROUTING -p tcp -d --dport 7999 -j DNAT --to
iptables -A FORWARD -p tcp -d --dport 7999 -j ACCEPT

When I connect to the A ( from the outside world I am connecting successfully. But I am falling when I try to connect to B from A (connection timed out).

What rules should I create to be able to connect to from

share|improve this question

You have a NAT hairpin situation here, which your current iptables rules don't support. When the container sends the request out the packet looks like this: ->

The gateway then DNATs the packet to this, and sends it back to the container: ->

The container receives the packets and sends a response which looks like this: ->

i.e. it's directly addresses to the container itself. But port 12345 doesn't know about a connection with, because the connection was with, and so the response is ignored.

The solution is to also SNAT the packet on the gateway so that the response goes back to the gateway, which then undoes both NATs. Try adding something like this:

iptables -t NAT -A POSTROUTING -o lxcbr0 -d -s -j SNAT --to
share|improve this answer
after adding this rule I am getting same problem. I tried to connect to (connection refused) from B and to (connection timed out) – Andrey Kuznetsov Feb 5 '13 at 14:17
@AndreyKouznetsov Then start using tcpdump to see where the packets go and what they look like. – mgorven Feb 5 '13 at 17:08
yes, I am already learning it. – Andrey Kuznetsov Feb 6 '13 at 0:06

I think the problem you're experiencing is that the answer is coming back on a different interface.

Initial Request




At this point, host A makes the decision to route to using the private network interface.


S: (IP of default GW interface on B)

The reply packet from B will traverse the default gateway and more than likely come back to A on its public interface, at which point the packet is discarded because there is no matching entry in the connection tracking table.


Add the following rule to ensure the reply traverses the same path as the request.

iptables -t nat -I POSTROUTING -s -d -o (interface of -j SNAT --to
share|improve this answer
Same problem :( I still can't connect to from – Andrey Kuznetsov Feb 4 '13 at 9:23
The command I used was iptables -t nat -I POSTROUTING -s -d -o lxcbr0 -j SNAT --to – Andrey Kuznetsov Feb 4 '13 at 9:24
There's probably something I'm overlooking then. The best advice I can offer is to use tcpdump on server B to examine what the packet headers look like on the way in, and what the reply looks like. Remember that a server talking to itself will often prefer the lo interface (regardless of IP), and to check other interfaces for the reply if it is missing. You should also delete that POSTROUTING rule until you are sure you know what is going on. – Andrew B Feb 4 '13 at 9:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.