I have this scenario:

  • a HOST machine running Debian with ufw installed.
  • a CentOS docker container that have an VM that working on an specific IP.
  • This VM have an app working on the container calling https://app.domain as put an entry in hosts file (APP_IP).

I want calling localhost:7000 on my HOST machine and use the VM app that is in the container.

I already exposed the port of the container while running it with -p 7000:7000.

I read about iptables and I tried to redirect the traffic on the container, but without success!

If this is the way... can anyone make an example of iptables command that I should run?

EDIT: Following this I tried:


echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING --protocol tcp --destination $APP_IP --dport 80 --source $IP_CONTAINER --jump DNAT --to-destination $APP_IP
iptables -t nat -A POSTROUTING -j MASQUERADE

but still without success!

  • I'm not following what you're trying to do. If you want a port on the host that will forward to a port in the container, the -p option you used should have done that. Jul 18 '20 at 0:22
  • It's not only the port as the container app that I would use outside the container work on a proper IP.
    – Kambei
    Jul 18 '20 at 7:32
  • 1
    Are you contacting ? You shouldn't need the IP forwarding or iptables rule.
    – Ned64
    Jul 18 '20 at 7:50
  • sorry, maybe I was not clear enough! The app is inside a VM in the CentOS docker container. For that expose only the port isn't enough. I've edited the question.
    – Kambei
    Jul 19 '20 at 16:16

I was able to connect to the app, inside the VM that is inside the CentOS Docker container, from Host using a proxy properly configured in the CentOS container that forward traffic from the container's exposed IP to VM ip and app port!

So the way is... a proxy inside the container!

I used HAProxy with this configuration for haproxy.conf:

log local0

log global
mode http
timeout connect 5000
timeout check 5000
timeout client 30000
timeout server 30000

frontend apps
option tcplog
mode tcp
default_backend apps

backend apps
mode tcp
balance roundrobin
option ssl-hello-chk
server webserver1 APP_IP:APP_PORT check

frontend api
bind CONTAINER_IP:6443
option tcplog
mode tcp
default_backend api

backend api
mode tcp
balance roundrobin
option ssl-hello-chk
server webserver1 APP_IP:APP_PORT check

and I have enabled forwarding for the container:

$ sysctl net.ipv4.conf.all.forwarding=1
$ sudo iptables -P FORWARD ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.