2

I have an Ubuntu Docker image running in Kubernetes and I'm trying to set up port forwarding to route requests coming in on port 5000 to a different destination and port (10.30.8.191:443). I installed iptables (not installed by default) and added the following rules:

iptables -A PREROUTING -t nat -p tcp --dport 5000 -j DNAT --to 10.30.8.191:443
iptables -A FORWARD -p tcp -d 10.30.8.191 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

I also verified /proc/sys/net/ipv4/ip_forward is set to 1. However, making a curl call to https://127.0.0.1:5000 results in connection refused. I have verified that the destination ip 10.30.8.191 is directly accessible from this host.

Any ideas what I might be missing? I haven't specified an interface in my iptables rules, which to my understanding means the rules should apply to all existing interfaces. Is that not the case?

1 Answer 1

2
  • Local originated packets don't pass through nat/PREROUTING chain. To make request to 127.0.0.1:5000 success you should add same DNAT rule into nat/OUTPUT chain:
iptables -t nat -A OUTPUT \
         -d 127.0.0.1 -p tcp --dport 5000 \
    -j DNAT --to 10.30.8.191:443
  • It also requires the changing of net.ipv4.conf.lo.route_localnet variable:
sysclt -w net.ipv4.conf.lo.route_localnet=1
  • Reply packets should pass through your ubuntu host, otherwise you get the routing triangle issue. To do it you should add SNAT rule:
iptables -t nat -A POSTROUTING \
         -d 10.30.8.191 -p tcp --dport 443 \
         -m conntrack --ctstate DNAT --ctorigdstport 5000 \
    -j MASQUERADE
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .