I have a service running in a network namespace and few iptables rules to expose it to the external world.

The following commands are an example of my setup:

sudo ip netns add ns1
sudo ip link add veth1_ type veth peer name veth1
sudo ip link set veth1_ netns ns1
sudo ip netns exec ns1 ifconfig veth1_ up
sudo ifconfig veth1 up

sudo iptables -P FORWARD ACCEPT
sudo iptables -t nat -A POSTROUTING -o veth1 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 50000 -j DNAT --to-destination

sudo ip netns exec ns1 netcat -l 8000

I am able to access the service through the :50000 port, so not issues so far.

I also need to route packets originating from that network namespace and going to a specific IP address through an special interface, in order to do it I use a source routing policy.

sudo ip route add via X.X.X.X table 1000
sudo ip rule add from iif veth1 to lookup 1000

When I try to access the service from host it doesn't work while it works from any other host.

My question is, why is this source based policy route affecting the traffic?, packets going into veth1 are masquerated, so the answer should not match those rules. Is my reasoning wrong?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.