Have you looked at using the proxy device in LXD with nat=true as that effectively automates the setup of these iptables rules, including the loopback rule to allow the container to connect to the external IP and have it forwarded back into the container.
lxc config device add alp p7 proxy listen=tcp:a.b.c.d:7777 connect=tcp:0.0.0.0:7777
lxc config device set alp p7 nat=true listen=tcp:a.b.c.d:7777 connect=tcp:0.0.0.0:7777
In this case telnet a.b.c.d 7777 works ok from outside, it works from within the container itself, but it does not work from inside the host or from inside other containers.
I run internal DNS on local IP 172.16.172.233:53. I did this kind of setup for port 53, tcp and udp. Now container can talk to its dns via external IP address, I can connect to external IP and resolve from outside, but a) host itself can’t query DNS via external address and other containers can’t do that as well.
Jul 6 15:38:09 ns lxd.daemon[31233]: t=2020-07-06T15:38:09+0300 lvl=warn msg="Proxy bridge netfilter not enabled: br_netfilte
r not loaded: open /proc/sys/net/bridge/bridge-nf-call-iptables: no such file or directory. Instances using the bridge will no
t be able to connect to the proxy's listen IP"
Ok, thanks. I think it should be documented somewhere clearly, because whole process is not obvious and scattered around this forum… including this tiny detail about kernel module not loaded by default. And that you have to use two commands to create a proxy and then to set it into nat mode.
Nevermind. For some reasons I used add and then set as two commands. I looked up my zsh history and it seems that first hints I found on the net used ‘lxc config device set’, lxc complained about missing device, I became confused and used two commands – created proxy without nat and then set it into nat mode.
Anyway, clear guide how to set up port forwarding and preserve remote IPs would be great.
I will look at adding a mention for br_netfilter to the proxy doc.
If you were able to write a post on the forum for setting up a proxy in nat mode then I could promote that into the Tutorials category for the benefit of other users.
lxc config device add alp proxy80v6 proxy listen=tcp:2604:280:1:5f8::2:80 connect=tcp:0.0.0.0:80
Error: Invalid devices: Device validation failed "proxy80v6": Invalid value for device option "listen": address 2604:280:1:5f8::2:80: too many colons in address
lxc config device add alp proxy80v6 proxy nat=true "listen=tcp:[2604:280:1:5f8::2]:80" "connect=tcp:[::]:80"
Error: Failed to start device "proxy80v6": Proxy connect IP cannot be used with any of the instance NICs static IPs
I was able to add v4 proxy to this container without problems.
You need to use static IPs for both IPv4 and IPv6 (when using proxy in nat mode), please show the output of lxc config show <container> --expanded for the container you added the IPv4 proxy device on.