I have an existing application that relies on some custom iptables logic
to function inside our network. It uses several rules along the lines of:
iptables -t nat -A OUTPUT -j DNAT -p tcp --dst x.x.x.x --dport 7000 -o
eth0 --to-destination y.y.y.y
There are several nodes and there is a DNAT rule for each node. I am
using centos6 privileged containers with macvlan. iptables appears to
basically work. For example, dropping all ICMP traffic or blocking a
specific port acts has expected. However, DNAT rules like the above
only work [1] if containers that happen to be colocated on the same
physical host.
I could imagine ways that lxc + macvlan + iptables could result in some
source IP based edge cases, but I'm very confused what is happening with
destination based rules.
[1] Tested with telnet + nc to rule out anything application specific.
_______________________________________________
lxc-users mailing list
[email protected]
http://lists.linuxcontainers.org/listinfo/lxc-users
