I am currently using wider_world_to_container rules to "bind" containers to localhost. If there is another way of doing this please let me know.
[[wider_world_to_container.rules]]
network = "network"
dst_container = "container"
expose_port = [9999]
external_network_interface = "lo"
With the above config I would expect a connection from the host running the dockers to 127.0.0.1 port 9999 to be routed to the container container on the docker network network
I notice that the dnat rules this config creates are placed in the following (other rules are removed)
table ip dfw {
chain prerouting {
type nat hook prerouting priority dstnat - 5; policy accept;
tcp dport 9999 iifname "lo" meta mark set 0x000000df dnat to 172.29.0.3:9999
}
}
table inet dfw {
chain forward {
type filter hook forward priority filter - 5; policy accept;
....
tcp dport 9999 ip daddr 172.29.0.3 iifname "lo" oifname "br-network" meta mark set 0x000000df accept
}
}
this might work for external traffic but localhost traffic does not pass the prerouting nat chain but instead uses the output nat chain with the following I can allow this.
nft 'add chain inet dfw output { type nat hook output priority -5; }'
nft 'insert rule inet dfw output meta mark set 0x000000df oifname "lo" tcp dport 9999 dnat ip to 172.29.0.3:9999'
nft 'insert rule ip dfw postrouting ip saddr 127.0.0.1 oifname "br-network" tcp dport 9999 masquerade'
I am currently using
wider_world_to_container rulesto "bind" containers to localhost. If there is another way of doing this please let me know.With the above config I would expect a connection from the host running the dockers to
127.0.0.1 port 9999to be routed to the containercontaineron the docker networknetworkI notice that the dnat rules this config creates are placed in the following (other rules are removed)
this might work for external traffic but localhost traffic does not pass the
prerouting nat chainbut instead uses theoutput nat chainwith the following I can allow this.