Let's consider a server running MySQL server, listening on

I would now like to give Docker containers running on the same host access to the MySQL server. MySQL would reject incoming connections, since they don't originate from, but from the container's IP. I could change the binding address of MySQL to '*', but then I would rely entirely on the firewall to prevent access from other networks. Therefore, I would prefer to keep MySQL listening on, and use iptables to "white list" the containers. I am not an iptables expert, so I just tried different combinations, using -t nat INPUT, PREROUTING, POSTROUTING, but couldn't get it to work so far. I also set "net.ipv4.conf.docker0.route_localnet" to 1, since that looks necessary.

How can I make iptables set the source address to for all packets coming on the docker0 interface (or a specific IP or network), and handle the following address translation?

  • 1
    If you NAT the source address to the loopback address, you could never send a reply back to a request because anything sent to the loopback address for a reply will loop right back into the server. Loopback addresses, by definition, are not allowed to be routed.
    – Ron Maupin
    Commented Nov 13, 2016 at 16:59
  • @RonMaupin isn't that the point of the route_localnet option? "route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/8 for local routing purposes. default FALSE"
    – ocroquette
    Commented Nov 13, 2016 at 17:49
  • Can someone tell me why my question is downvoted?
    – ocroquette
    Commented Nov 13, 2016 at 17:51
  • Then that doesn't follow RFC 6890, which says that anything in the range is not forwardable.
    – Ron Maupin
    Commented Nov 13, 2016 at 17:58
  • 1
    I have noticed that many things in Linux don't really follow the RFCs. It may be that Linux allows loopback addresses to be routed internally, but that could break some things in other RFCs, e.g. detecting MPLS data plane failures and BFD, which depend on those addresses to not be routable. Loopback addresses should not get sent to a routing process. Anything sent to a loopback address should immediately be sent right back into the host, bypassing the routing process.
    – Ron Maupin
    Commented Nov 13, 2016 at 18:16

1 Answer 1


Answering my own question: it looks like iptables is the wrong tool for the job. I installed rinetd and configured it like this:

# bindadress    bindport    connectaddress  connectport      3308       3306

rinetd binds only to the Docker address (, and forwards connection from the containers to the MySQL server running on the host. From MySQL's perspective, the connections are coming from, so it happily accepts them.

It would be much easier if MySQL would support multiple bind addresses, but since the corresponding feature request have been open for 11 years, I guess it is not going to be implemented any time soon (https://bugs.mysql.com/bug.php?id=14979).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .