6

I am trying to get port fowarding to work to expose a LXC container, when using ufw on Ubuntu, but to no avail. I have constructed the following workflow from guides around the Internet ([1][2][3]); most notably the section about /etc/ufw/before.rules I see repeated all over the place but .... I cannot get it to work for me.

If anybody follows this guide and finds success.... do let me know (so I may first weep, and then fall back and write my own firewalling tool)

Steps to reproduce/test

Setup

  1. Test environment

    • New VM (I used virtualbox) "host1" with both a NAT and NAT Network interface
      • Install Ubuntu server 16.04 - just do a default installation
    • Second VM instance "host2", on same NAT Network
  2. LXC installation on host1 - I am doing this with plain LXC, not introducing LXD setups yet

    • sudo lxc-create -n web -t download -- -d centos -r 7 -a amd64
    • sudo lxc-start -n web
    • sudo lxc-attach -n web
      • yum install httpd ; yum enable httpd ; yum start httpd
      • exit

We assume now that

  • NAT Network interface on host1 is enp0s8 and
  • the container IP on host1 is 10.0.3.101
  • the IP of host1's enp0s8 is 10.0.2.6
  • See that with sudo iptables -L -t nat that the masquerading has already been configured by the LXC install

You may want to snapshot this base state.

At this point two routes: A-route with plain iptables, and B-route, the problematic one, with ufw

  1. A - iptables
    • sudo iptables -t nat -A PREROUTING -i enp0s8 -p tcp --dport 8080 -j DNAT --to "10.0.3.101:80"
    • On the second host I can wget http://10.0.2.6:8080 and this gives me the standard CentOS landing page. Success!

The problem

  1. B - this can be done after a reboot of host1 or, if you snapshotted earlier, just revert. Either way, it behaves the same
    • Edit /etc/default/ufw
      • set MANAGE_BUILTINS=yes
      • set DEFAULT_FORWARD_POLICY="ACCEPT"
    • Edit /etc/ufw/sysctl.conf
      • uncomment net/ipv4/ip_forward=1
    • Edit /etc/ufw/before.rules
      • Insert the nat lines (see below [4]) under the lead comments, but above the *filter line
      • Adjusting of course for the relevant configurations
    • ufw allow 8080
    • ufw enable
    • At this point, I cannot reach host1 from host2 with wget, firefox, etc - connection cannot be established
    • If I do nc -l 8080 on host1 and try connecting again from host2, I get the HTTP header dump - indicating that no port forwarding is occurring. FAIL!

I've gone over my steps about short of 5 different times now with fresh VMs, digitalOcean droplets and AWS EC2 instances - no luck, always the same.

Can anybody point out what I am doing wrong ...?

1
  • At this point I actually have written a firewalling script supporting profiles, raw entries and transferable configurations. I think I'll have to abandon using ufw for LXC machines... github.com/taikedz/vefirewall
    – taifwa
    Apr 2, 2017 at 16:20

1 Answer 1

3

Turns out there are a few more configuration steps that are needed to allow general traffic to flow:

At the top of /etc/ufw/before.rules, before the *filter section

*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -i enp0s8 -p tcp --dport 8080 -j DNAT --to 10.0.3.101:80
COMMIT

And near the bottom, before the final COMMIT:

-A FORWARD -o lxcbr0 -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT

-A INPUT -p udp --dport 53 -i enp0s8 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 53 -i enp0s8 -m state --state NEW -j ACCEPT
-A INPUT -p udp --dport 67 -i enp0s8 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 67 -i enp0s8 -m state --state NEW -j ACCEPT

At the top of /etc/ufw/after.rules, before the filter section:

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT

That did it for my test environment, as outlined in the problem description.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.