Do iptables redirect from frontend to loopback?

Question

I am trying to redirect a port from my lxc container to loopback.

My lxc container configured with the lxcbr1 bridge 11.0.3.1.

I am trying to connect with netcat from host to lxc and from lxc to host. Success.

local:

# nc -l 1088 

LXC:

 # nc 11.0.3.1 1088 Hello! 

And localhost See message: "Hello!". Success!

When I redirect the port this way:

 # iptables -t nat -A PREROUTING -i lxcbr1 -p tcp -d 11.0.3.1 --dport 1088 -j DNAT --to-destination 127.0.0.1:1088 # nc -l 127.0.0.1 1088 

Subsequently, I try to connect to the lxc container:

 # nc 11.0.3.1 1088 Hello ! 

But localhost does not see this message.

Where am I mistaken?

I found this answer: https://serverfault.com/questions/211536/iptables-port-redirect-not-working-for-localhost

The word sounds that loopback does not use PREROUTING. What should I do?

Answer 1

DNAT is not possible for circular traffic.

I have found many similar questions. 1 , 2 , 3 , etc.

According to RFC 5735, the network 127.0.0.0/8 should not be routed outside the host itself:

127.0.0.0/8 - This block is assigned to be used as the loopback address of the Internet host. A datagram sent by a higher level protocol for an address somewhere inside this block goes back inside the host. This is usually implemented using only 127.0.0.1/32 for loopback. As described in [RFC1122], Section 3.2.1.3, addresses for a total of 127.0.0.0/8 are not blocked in any network anywhere.

RFC 1700 , p. 5, "Should never appear outside the host."

There is one way out: use inetd .

There are many built-in servers, xinetd, etc.

My choice was rinetd.

I am using this guide http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

My config is as follows:

 $ cat /etc/rinetd.conf # bindadress bindport connectaddress connectport 11.0.3.1 1081 127.0.0.1 1081 11.0.3.1 1088 127.0.0.1 1088 

I will restart rinetd:

 $ /etc/init.d/rinetd restart Stopping internet redirection server: rinetd. Starting internet redirection server: rinetd. 

And the redirection works like a charm.

I will not close this question myself, because I'm still looking for a more elegant solution to such a problem. It is unlikely that any animal, netcat or inetd, would do this; it does not matter. It's my opinion.