<div dir="ltr">Just figured it out a fix, I think. For containers to address each other by both external and internal IPs, I set the DNAT rule on the OUTPUT and PREROUTING chain, instead of just on the PREROUTING as above. </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 18, 2014 at 11:03 PM, Shidan <span dir="ltr"><<a href="mailto:shidan@gmail.com" target="_blank">shidan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think the case of having a 1 to 1 assignment of external IPs to containers is an important use case to document somewhere. </div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 18, 2014 at 12:09 PM, Shidan <span dir="ltr"><<a href="mailto:shidan@gmail.com" target="_blank">shidan@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hello I have multiple external IP addresses and set up iptables so that each container is assigned one external IP on the <span style="color:rgb(51,51,51);font-family:Ubuntu,'Ubuntu Beta','Bitstream Vera Sans','DejaVu Sans',Tahoma,sans-serif;font-size:13px;line-height:19.5px">lxcbr0 NATed bridge in a 1 to 1 fashion similar to this example:</span></div><div><span style="color:rgb(51,51,51);font-family:Ubuntu,'Ubuntu Beta','Bitstream Vera Sans','DejaVu Sans',Tahoma,sans-serif;font-size:13px;line-height:19.5px"><br></span></div><div>root@SERVER:/var/log# iptables -t nat -L</div><div>Chain PREROUTING (policy ACCEPT)</div><div>target prot opt source destination </div><div>DNAT all -- anywhere <span style="color:rgb(51,51,51);font-family:'Helvetica Neue',sans-serif;font-size:13px;line-height:20px;white-space:nowrap">188.227.224.138</span> to:10.0.3.2</div><div>DNAT all -- anywhere <span style="color:rgb(51,51,51);font-family:'Helvetica Neue',sans-serif;font-size:13px;line-height:20px;white-space:nowrap">188.227.224.139</span> to:10.0.3.3</div><div><br></div><div><br></div><div>Chain INPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div><br></div><div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div><br></div><div>Chain POSTROUTING (policy ACCEPT)</div><div>target prot opt source destination </div><div>SNAT all -- 10.0.3.2 !<a href="http://10.0.3.0/24" target="_blank">10.0.3.0/24</a> to:<span style="color:rgb(51,51,51);font-family:'Helvetica Neue',sans-serif;font-size:13px;line-height:20px;white-space:nowrap">188.227.224.138</span></div><div>SNAT all -- 10.0.3.3 !<a href="http://10.0.3.0/24" target="_blank">10.0.3.0/24</a> to:<span style="color:rgb(51,51,51);font-family:'Helvetica Neue',sans-serif;font-size:13px;line-height:20px;white-space:nowrap">188.227.224.139</span></div><div><br></div><div><br></div><div>Now when I try to access a container from another container, I am just hitting the host, so for ssh for example, even if I try the IPs <span style="color:rgb(51,51,51);font-family:'Helvetica Neue',sans-serif;font-size:13px;line-height:20px;white-space:nowrap">188.227.224.139</span> or 10.0.3.3 from the 10.0.3.2 container I will actually connect to the physical hosts SSH daemon. Everything works fine from one connecting from/to external machines. </div><div><br></div><div>What am I doing wrong. </div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>