I have service A running on the host and binding to port

I have service B running inside my LXC container which want to connect to service A via but currently can't.

How do I setup the container or iptables to forward the traffic?


On the container side you should add these rules:

iptables -t nat -A OUTPUT \
         -d \
         -p tcp --dport 7800 \
    -j DNAT --to-address <HOST.EXT.IP>

iptables -t nat -A POSTROUTING \
         -o <LXC.HOST.IFACE> \
         -d <HOST.EXT.IP> -s \
         -p tcp --dport 7800 \

Also it requires enabling of net.ipv4.conf.all.route_localnet sysctl option.

Because on the host app listens only address, that means it cannot accept the external connections by default. But you can use the DNAT/REDIRECT targets as workaround.

iptables -t nat -A PREROUTING \
         -i <HOST.LXC.IFACE> \
         -d <HOST.LXC.IP> -s <LXC.IP> \
         -p tcp --dport 7800 \
    -j DNAT --to-address

It also requires enabled route_localnet option.

Use the iptables-save -c (check the rule counters) and tcpdump to troubleshoot.

  • Thanks, this improves my understanding. With tcpdump I see the following: IP localhost.57690 > hostHostname.7800 . This means the host will have trouble to respond since the source IP is seen as localhost? – gavenant May 24 at 15:17
  • Yep. You should add MASQUERADE rule – Anton Danilov May 24 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.