0

I've just noticed that MASQUERADE iptables rule added by lxc has ! -d part:

iptables -t nat -A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE

My guess is that -s 10.0.3.0/24 -d 10.0.3.0/24 can only be observed when sending data from one container to the other one (ping, ssh, you name it). And omitting the ! -d part can only affect performance. To unknown extent. Am I right?

0

This rule allows two different containers on the same subnet to talk to each other without being NAT'd

So a container with 10.0.3.100 talking to 10.0.3.101 will appear as 10.0.3.100 to the other container and not as the host address.

This can be beneficial for various purposes (e.g. logging of activity, access controls) because the target container can identify the source container. It also allows these containers to not need default routes (it's all local subnet) so can be beneficial from a security perspective.

And, of course, it removes unnecessary NAT overhead!

  • I just tried to run two LXC containers (10.0.0.100, 10.0.0.200) on local machine with iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE, tcpdump icmp on one, ping -c 1 10.0.0.100 on the other. And tcpdump says the IP is 10.0.0.200. – x-yuri Dec 28 '18 at 7:27
  • I was told that by default iptables doesn't process inter-container traffic, but that can be enabled system-wide. – x-yuri Dec 28 '18 at 13:06
  • Yeah, it's part of the "defensive configuration"; build for the worst case (what if...) so that changes made elsewhere don't break the local stuff. – Stephen Harris Dec 28 '18 at 13:28
  • Afaik this NAT avoidance wouldn't be needed with "normal" settings because the two containers are bridged, not routed. It could happen when br_netfilter is activated, according to explanation below fig 7b in ebtables/iptables interaction on a Linux-based bridge – A.B Feb 14 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.