I have a service running in a network namespace and few iptables rules to expose it to the external world.
The following commands are an example of my setup:
sudo ip netns add ns1 sudo ip link add veth1_ type veth peer name veth1 sudo ip link set veth1_ netns ns1 sudo ip netns exec ns1 ifconfig veth1_ 192.168.0.2/24 up sudo ifconfig veth1 192.168.0.1/24 up sudo iptables -P FORWARD ACCEPT sudo iptables -t nat -A POSTROUTING -o veth1 -j MASQUERADE sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 50000 -j DNAT --to-destination 192.168.0.2:8000 sudo ip netns exec ns1 netcat -l 8000
I am able to access the service through the :50000 port, so not issues so far.
I also need to route packets originating from that network namespace and going to a specific IP address through an special interface, in order to do it I use a source routing policy.
sudo ip route add 172.23.23.23 via X.X.X.X table 1000 sudo ip rule add from 192.168.0.2 iif veth1 to 172.23.23.23 lookup 1000
When I try to access the service from host 172.23.23.23 it doesn't work while it works from any other host.
My question is, why is this source based policy route affecting the traffic?, packets going into veth1 are masquerated, so the answer should not match those rules. Is my reasoning wrong?