I have a LXC container ( running on a host. A service is running inside the container on port 7000.

From the host (, lxcbr0), I can reach the service:

$ telnet 7000
Connected to
Escape character is '^]'.

I'd love to make the service running inside the container accessible to the outer world. Therefore, I want to forward port 7002 on the host to port 7000 on the container:

iptables -t nat -A PREROUTING -p tcp --dport 7002 -j DNAT --to

Which results in (iptables -t nat -L):

DNAT   tcp  --  anywhere     anywhere     tcp dpt:afs3-prserver to:

Still, I cannot access the service from the host using the forwarded port:

$ telnet 7002
telnet: Unable to connect to remote host: Connection refused

I feel like I'm missing something stupid here. What things should I check? What's a good strategy to debug these situations?

For completeness, here is how iptables are set on the host:

iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X

iptables -P INPUT DROP

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o lxcbr0 -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp --dport 7002 -j DNAT --to
  • Did you check the INPUT chain? Maybe the policy is REJECT there. – Michael Härtl Mar 13 '13 at 17:48
  • Policy is ACCEPT – Roberto Aloi Mar 13 '13 at 17:50
  • Sorry, i meant the FORWARD chain. Also check if IP forwarding is enabled: cat /proc/sys/net/ipv4/ip_forward. – Michael Härtl Mar 13 '13 at 17:52
  • ip_forward is set to 1 – Roberto Aloi Mar 13 '13 at 17:54
  • FORWARD policy is also ACCEPT – Roberto Aloi Mar 13 '13 at 17:56

Seems you have blocked 7002 port on as your default policy is DROP

Try adding it to INPUT rules:

iptables -A INPUT -p tcp --dport 7002 -j ACCEPT

I ran into the same problem. I have not found solution yet, but following I note down some observations.

I have a host ${host} machine (Ubuntu 12.04) and it runs a guest machine via LXC. The guest is on IP and gateway is I run a web server in the guest and want to port forward traffic from ${host}:8888 to Following is the relevant iptables entries:

-A PREROUTING -p tcp --dport 8888 -j DNAT --to-destination

With the current configuration, I can successfully visit the web server on from another physical machine. However, it fails when I try to visit from ${host}. Maybe you can try to visit that service inside LXC from another machine.

My understanding is that, when I visit from ${host}, the packet go through loopback interface and enters the INPUT chain directly. Although I allow everything on INPUT, there is no service listening at ${host}:8888. From wireshark, I see a RST is sent received. When I visit from another physical machine, the packet goes into PREROUTING chain and was DNAT-ed as expected.

One related post:


I needed to add a FORWARD rule

iptables -A FORWARD -p tcp -d --dport 7002 -j ACCEPT

ok, my 5 cents from year 2018:

I did install LXC and play around it. My container IP is

I added this rule:

iptables -t nat -A PREROUTING -p tcp -i ens192 --dport 81 -j DNAT --to-destination

It did not worked. Then I realized, that even FORWARD policy is ACCEPT, there is a rule that blocks all FORWARD's.

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      virbr0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *           
    0     0 ACCEPT     all  --  virbr0 virbr0             
    5   268 REJECT     all  --  *      virbr0              reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *              reject-with icmp-port-unreachable

So I had to inject rule at the top:

iptables -I FORWARD -p tcp -d --dport 22 -j ACCEPT

Now forward host:81 -> works.


Your container is accessible from LAN via a host bridge interface, and thus connected to the same subnet as the host.

You need to have your router forward those ports to your container.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.