{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxd/issues/1102","labels_url":"https://api.github.com/repos/lxc/lxd/issues/1102/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxd/issues/1102/comments","events_url":"https://api.github.com/repos/lxc/lxd/issues/1102/events","html_url":"https://github.com/lxc/lxd/issues/1102","id":106207879,"number":1102,"title":"Port Forwarding with Multiple Network Interfaces","user":{"login":"ak5","id":3480383,"avatar_url":"https://avatars.githubusercontent.com/u/3480383?v=3","gravatar_id":"","url":"https://api.github.com/users/ak5","html_url":"https://github.com/ak5","followers_url":"https://api.github.com/users/ak5/followers","following_url":"https://api.github.com/users/ak5/following{/other_user}","gists_url":"https://api.github.com/users/ak5/gists{/gist_id}","starred_url":"https://api.github.com/users/ak5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ak5/subscriptions","organizations_url":"https://api.github.com/users/ak5/orgs","repos_url":"https://api.github.com/users/ak5/repos","events_url":"https://api.github.com/users/ak5/events{/privacy}","received_events_url":"https://api.github.com/users/ak5/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-13T09:40:53Z","updated_at":"2015-09-14T20:56:07Z","closed_at":"2015-09-14T20:56:07Z","body":"Hi!\r\n\r\nI have a strange issue where I can access my container via iptables forwarded port on one interface, but not on another.\r\n\r\nI have 2 interfaces with a public IP for each and a container running on 10.0.3.253 with a simple webservice.\r\n\r\nFrom the LXD host:\r\n\r\n```bash\r\n$ curl -L 10.0.3.253\r\nHello World\r\n````\r\n\r\nSo that works.\r\n\r\nHere is my iptables config:\r\n\r\n```bash\r\n$ iptables -t nat -nVL\r\nChain PREROUTING (policy ACCEPT 2931 packets, 180K bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n   47  2588 DNAT       tcp  --  eth+   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:10.0.3.253:80\r\n\r\nChain INPUT (policy ACCEPT 2924 packets, 179K bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain OUTPUT (policy ACCEPT 17669 packets, 1276K bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain POSTROUTING (policy ACCEPT 17684 packets, 1277K bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    4   304 MASQUERADE  all  --  *      *       10.0.3.0/24         !10.0.3.0/24\r\n```\r\n\r\n```bash\r\n$ iptables -t nat -S\r\n-P PREROUTING ACCEPT\r\n-P INPUT ACCEPT\r\n-P OUTPUT ACCEPT\r\n-P POSTROUTING ACCEPT\r\n-A PREROUTING -i eth+ -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.3.253:80\r\n-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE\r\n```\r\n\r\nMy interfaces are eth0 and eth1 - public IP of eth0 works, while that of eth1 does not (timeout). I am testing this from my laptop.\r\n\r\nI asked on ##linux on freenode if my iptables is setup ok - answer was yes - it \"should\" work.\r\n\r\nSo now I am thinking if it's not that, it must be something on LXD side, but I didn't find anything related to this. Please let me know if this can possibly be LXD related."},"comment":{"url":"https://api.github.com/repos/lxc/lxd/issues/comments/140203640","html_url":"https://github.com/lxc/lxd/issues/1102#issuecomment-140203640","issue_url":"https://api.github.com/repos/lxc/lxd/issues/1102","id":140203640,"user":{"login":"stgraber","id":2230599,"avatar_url":"https://avatars.githubusercontent.com/u/2230599?v=3","gravatar_id":"","url":"https://api.github.com/users/stgraber","html_url":"https://github.com/stgraber","followers_url":"https://api.github.com/users/stgraber/followers","following_url":"https://api.github.com/users/stgraber/following{/other_user}","gists_url":"https://api.github.com/users/stgraber/gists{/gist_id}","starred_url":"https://api.github.com/users/stgraber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stgraber/subscriptions","organizations_url":"https://api.github.com/users/stgraber/orgs","repos_url":"https://api.github.com/users/stgraber/repos","events_url":"https://api.github.com/users/stgraber/events{/privacy}","received_events_url":"https://api.github.com/users/stgraber/received_events","type":"User","site_admin":false},"created_at":"2015-09-14T20:56:07Z","updated_at":"2015-09-14T20:56:07Z","body":"Sounds to me like this is a simple case of asymmetric routing. Presumably your default gateway is eth0, so the container will get the connection through your NAT rule but when answering to the source IP will be routed through eth0 causing the response to be lost.\r\n\r\nOne easy way to debug this is to have your container ping that source IP, once it does ping and you confirm that the traffic goes out through eth1 on the host (using tcpdump or similar), then an incoming connection should work as expected.\r\n\r\nIf you don't have a specific set of subnets that should be routed through eth1 but instead can have any number of hosts connecting to either eth0 or eth1, as would be the case with two WAN connections, then you'll instead want to look at doing source based routing, basically marking the incoming connection through iptables rules and force the response to go through the same interface.\r\n\r\nA quick and dirty workaround here though would be to add a SNAT rule too, basically rewriting the source address to be the host's, therefore avoiding the outgoing routing issue, but note that doing so will prevent the service inside your container from knowing who connected to it.\r\n\r\nAnyway, this is a standard issue which isn't in any way specific to LXC or LXD. You should be able to find a good number of documentation and howtos on how to make that kind of setup work by looking for multiwan.\r\n\r\nClosing this issue as it's not a LXD bug."}}