iptables port forwarding A -> B -> A [closed]

Question

I have a host machine(A) with lxc-container(B). A's local ip address is 10.0.3.1 and public ip, let's say 1.2.3.4. B's local ip address is 10.0.3.21.

I need 1.2.3.4:7999 to be forwarded to 10.0.3.1:7999 and I created the following rules for that:

iptables -t nat -I PREROUTING -p tcp -d 1.2.3.4 --dport 7999 -j DNAT --to 10.0.3.21:7999
iptables -A FORWARD -p tcp -d 10.0.3.21 --dport 7999 -j ACCEPT

When I connect to the A (1.2.3.4:7999) from the outside world I am connecting successfully. But I am falling when I try to connect to B from A (connection timed out).

What rules should I create to be able to connect to 1.2.3.4:7999 from 10.0.3.1?

Answer 1

If I understand (I am not familiar with lxc-container), I don't think what you are trying to do is possible on most routers.

See http://forum1.netgear.com/showthread.php?t=76215, for example.

Port forwarding is part of NAT (Network Address Translation) and in most cases can only be done when accessing the network from the outside. I tried to do the exact same thing a few months ago and this was the conclusion I reached. You an I are trying to leave the network and come back into it so the translation will be done.

If we try to access another computer on the same network, we should use the "local" IP - in your case 10.0.3.1.

If you do find a way to do it, post it. I'd like to know.