I've just noticed that MASQUERADE iptables rule added by lxc has ! -d part:

iptables -t nat -A POSTROUTING -s ! -d -j MASQUERADE

My guess is that -s -d can only be observed when sending data from one container to the other one (ping, ssh, you name it). And omitting the ! -d part can only affect performance. To unknown extent. Am I right?

1 Answer 1


This rule allows two different containers on the same subnet to talk to each other without being NAT'd

So a container with talking to will appear as to the other container and not as the host address.

This can be beneficial for various purposes (e.g. logging of activity, access controls) because the target container can identify the source container. It also allows these containers to not need default routes (it's all local subnet) so can be beneficial from a security perspective.

And, of course, it removes unnecessary NAT overhead!

  • I just tried to run two LXC containers (, on local machine with iptables -t nat -A POSTROUTING -s -j MASQUERADE, tcpdump icmp on one, ping -c 1 on the other. And tcpdump says the IP is
    – x-yuri
    Dec 28, 2018 at 7:27
  • I was told that by default iptables doesn't process inter-container traffic, but that can be enabled system-wide.
    – x-yuri
    Dec 28, 2018 at 13:06
  • Yeah, it's part of the "defensive configuration"; build for the worst case (what if...) so that changes made elsewhere don't break the local stuff. Dec 28, 2018 at 13:28
  • Afaik this NAT avoidance wouldn't be needed with "normal" settings because the two containers are bridged, not routed. It could happen when br_netfilter is activated, according to explanation below fig 7b in ebtables/iptables interaction on a Linux-based bridge
    – A.B
    Feb 14, 2019 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.