I have an existing application that relies on some custom iptables logic
to function inside our network. It uses several simple rules along the
lines of:
iptables -t nat -A OUTPUT -j DNAT -p tcp --dst x.x.x.x --dport 7000 -o
eth0 --to-destination y.y.y.y
There are several nodes and there is a DNAT rule for each node. I've
successfully been using rules like this on physical nodes for a few
years without difficulty.
I'm trying to replace these nodes with 'containers' on centos6.
Specifically by 'containers' I mean lxc with:
* privileged containers
* macvlan in bridge mode
* network namespace
And running into trouble with the same iptables rules. Specifically
what happens between container A (initiates connection) on host X and
container B (listening daemon) on host Y.
* A: syn
* B: syn+ack
* A: rst
I've detected the RST with tcpdump from both within the container and on
the host. Visually in wireshark it looks like:
http://i.imgur.com/lo1PF6k.png Basic DROP rules like 'block inbound on
this port' appear to work fine.
To add to the confusion, if A & B are co-located on the same physical
host it appears to work okay.
I'm at at loss to explain where the RST is coming from or how to make
the DNAT rule work correctly.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
