2

I'm trying to setup a docker virtualization environment. This is a follow up of this question.

I have a virtual eth0:0 interface, and I would like to forward it using iptables.

The public, main IP is 93.93.93.93

The failover IP is 5.6.7.8

I've a server where IP aliasing is configured:

/etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 93.93.93.93
        netmask 255.255.255.0
        network 93.93.93.0
        broadcast 93.93.93.255
        gateway 93.93.93.254

# IPFO 1
    post-up /sbin/ifconfig eth0:0 5.6.7.8 netmask 255.255.255.255 broadcast 5.6.7.8
    pre-down /sbin/ifconfig eth0:0 down

This way, when I ping eth0:0 from outside it works. It seems like the problem start from routing maybe?

root@aldebaran:~# ip route
default via 93.93.93.254 dev eth0 
93.93.93.0/24 dev eth0  proto kernel  scope link  src 94.23.55.226 
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1 

No sign of eth0.0

Then I add iptables rules:

iptables -A PREROUTING -t nat -i eth0:0 -p tcp --dport 80 -j DNAT --to 172.17.0.2:80
iptables -A FORWARD -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT

Then I try

root@aldebaran:~# curl 172.17.0.2:80
WORKS!
root@aldebaran:~# curl IP_FAILOVER
curl: (7) Failed to connect to IP_FAILOVER port 80: Connection refused

According to this tutorial, I haven't setup routing correctly. Is this right? How do I fix this?

2
  • 1
    Your use of placeholders is confusing and inconsistent (e.g. MAIN_IP.0 is not going to be correct, and confuses matters). It would be much easier to understand what you're doing if you had, if not real IP addresses, then fake but consistent ones (e.g. MAIN_IP = 1.1.1.1 or similar). Dec 28, 2014 at 20:57
  • updated the question
    – Mascarpone
    Dec 30, 2014 at 20:31

1 Answer 1

1

The problem was that I was using IP alias, which creates an interface that Iptables cant use. Eth0:0 is not a valid target. I should use instead:

iptables -t nat -I PREROUTING --dst 5.6.7.8 -p tcp --dport 80 -j DNAT --to 172.17.0.2:80
iptables -A FORWARD -p tcp -d 172.17.0.2 --dport 22 -j ACCEPT
iptables -t nat -A POSTROUTING -s 172.17.0.2 -j MASQUERADE
1
  • Man. I have spent 3 days on the very same issue. No one ever says anything about not being able to use -i eth0:0 as a prerouting origin. God damn, thank you.
    – SEJBR
    Feb 3, 2021 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .