Hello,
I have two LXD containers:
- the first, called “front”, has two network interfaces: one internal (host’s bridge lxdbr0) and a public ip (host’s bridge br0)
- the second, called “mysql”, with only an internal IP (host’s bridge lxdbr0)
I want to forward port 3306 from the public facing interface of “front” to the internal facing interface of “mysql” container. It doesn’t work as expected. I can connect from “front” to “mysql” on port 3306, but not from outside/public network.
Front’s config:
root@front:~# cat /etc/defaukt/ufw
[...]
DEFAULT_FORWARD_POLICY="ACCEPT"
[...]
root@front:~# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), allow (routed)
New profiles: skip
To Action From
-- ------ ----
443/tcp ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere
3306/tcp ALLOW IN Anywhere
443/tcp (v6) ALLOW IN Anywhere (v6)
80/tcp (v6) ALLOW IN Anywhere (v6)
3306/tcp (v6) ALLOW IN Anywhere (v6)
root@front:~# sysctl net/ipv4/ip_forward
net.ipv4.ip_forward = 1
root@front:~# sysctl net/ipv6/conf/default/forwarding
net.ipv6.conf.default.forwarding = 1
root@front:~# sysctl net/ipv6/conf/all/forwarding
net.ipv6.conf.all.forwarding = 1
root@front:~# cat /etc/ufw/before.rules
[...]
*nat
:PREROUTING ACCEPT [0:0]
-F
-A PREROUTING -i eth0 -p tcp --dport 3306 -j DNAT --to-destination 10.2.249.204:3306
[...]
root@front:~# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 536 packets, 53325 bytes)
pkts bytes target prot opt in out source destination
4 240 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306 to:10.2.249.204:3306
Chain INPUT (policy ACCEPT 77 packets, 4278 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 4615 packets, 277K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 4619 packets, 278K bytes)
pkts bytes target prot opt in out source destination
root@front:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
31: eth0@if32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:16:3e:6a:74:9c brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet [redacted]/24 brd 202.22.232.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 [redacted]/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe6a:749c/64 scope link
valid_lft forever preferred_lft forever
33: eth1@if34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:16:3e:4e:d0:c2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.2.249.2/24 brd 10.2.249.255 scope global dynamic eth1
valid_lft 3445sec preferred_lft 3445sec
inet6 fe80::216:3eff:fe4e:d0c2/64 scope link
valid_lft forever preferred_lft forever