Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a LXC container ( running on a host. A service is running inside the container on port 7000.

From the host (, lxcbr0), I can reach the service:

$ telnet 7000
Connected to
Escape character is '^]'.

I'd love to make the service running inside the container accessible to the outer world. Therefore, I want to forward port 7002 on the host to port 7000 on the container:

iptables -t nat -A PREROUTING -p tcp --dport 7002 -j DNAT --to

Which results in (iptables -t nat -L):

DNAT   tcp  --  anywhere     anywhere     tcp dpt:afs3-prserver to:

Still, I cannot access the service from the host using the forwarded port:

$ telnet 7002
telnet: Unable to connect to remote host: Connection refused

I feel like I'm missing something stupid here. What things should I check? What's a good strategy to debug these situations?

For completeness, here is how iptables are set on the host:

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X

iptables -P INPUT DROP

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o lxcbr0 -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp --dport 7002 -j DNAT --to
share|improve this question
Did you check the INPUT chain? Maybe the policy is REJECT there. – Michael Härtl Mar 13 '13 at 17:48
Policy is ACCEPT – Roberto Aloi Mar 13 '13 at 17:50
Sorry, i meant the FORWARD chain. Also check if IP forwarding is enabled: cat /proc/sys/net/ipv4/ip_forward. – Michael Härtl Mar 13 '13 at 17:52
ip_forward is set to 1 – Roberto Aloi Mar 13 '13 at 17:54
FORWARD policy is also ACCEPT – Roberto Aloi Mar 13 '13 at 17:56

Seems you have blocked 7002 port on as your default policy is DROP

Try adding it to INPUT rules:

iptables -A INPUT -p tcp --dport 7002 -j ACCEPT
share|improve this answer

I ran into the same problem. I have not found solution yet, but following I note down some observations.

I have a host ${host} machine (Ubuntu 12.04) and it runs a guest machine via LXC. The guest is on IP and gateway is I run a web server in the guest and want to port forward traffic from ${host}:8888 to Following is the relevant iptables entries:

-A PREROUTING -p tcp --dport 8888 -j DNAT --to-destination

With the current configuration, I can successfully visit the web server on from another physical machine. However, it fails when I try to visit from ${host}. Maybe you can try to visit that service inside LXC from another machine.

My understanding is that, when I visit from ${host}, the packet go through loopback interface and enters the INPUT chain directly. Although I allow everything on INPUT, there is no service listening at ${host}:8888. From wireshark, I see a RST is sent received. When I visit from another physical machine, the packet goes into PREROUTING chain and was DNAT-ed as expected.

One related post:

share|improve this answer

I needed to add a FORWARD rule

iptables -A FORWARD -p tcp -d --dport 7002 -j ACCEPT
share|improve this answer

Your container is accessible from LAN via a host bridge interface, and thus connected to the same subnet as the host.

You need to have your router forward those ports to your container.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.