I'm using ip6tables to nat packages to an IP on a different interface (localhost), but all packets sent there are lost.
I have the same iptables rules for IPv4 where everything is working fine.
Setup
The host is a debian 11 VM, the client is a docker container running debian:stable-slim.
/etc/docker/daemon.json:
{
"ipv6": true,
"fixed-cidr-v6": "2d00::/8",
"ip6tables": true,
"experimental": true
}
The host has the docker0 interface IPs 2d00::1 and 172.17.0.2 for IPv6 and IPv4 respectively.
I'm setting up the following ip(6)tables rules to NAT for IPv4 and IPv6 respectively:
ip6tables -t nat -A PREROUTING -d 2d00::1 -p tcp -m tcp --dport 8081 -j DNAT --to-destination [::1]:9999
iptables -t nat -A PREROUTING -d 172.17.0.2 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 127.0.0.1:9999
I have also appended the following rules to my /etc/sysctl.conf:
net.ipv4.ip_forward = 1
net.ipv4.conf.all.route_localnet = 1
net.ipv6.conf.all.use_tempaddr = 0
net.ipv6.conf.all.forwarding = 1
Minimal non-working example
Set up an HTTP server on the host, listening on [::1]:9999:
python3 -m http.server --bind ::1 9999
And try to connect to it from a client container:
docker run --rm -it --name client debian:stable-slim /bin/bash
apt update
apt install -y curl
curl http://[2d00::1]:8081
The result is that curl hangs for a while and continuously tries to establish a connection, but i never get a response.
Things i have tried and observed
I have done the same test as in the non-working example above for
- IPv4 with nat
- IPv6 without nat
- IPv6 with nat to an IP on the same interface as the original destination IP (i.e. just change the port, or NAT to the interface's link-local address)
and they all succeeded. So the only non-working case is IPv6 with NAT where the NAT wants to route to a different interface.
I have also added log outputs to various ip(6)tables chains and i could see that in the successful cases, i can observe packets arriving at the filter table's INPUT chain, as well as the nat table's PREROUTING chain.
As soon as i try to NAT IPv6 traffic to a different interface, i no longer get any packets arriving at any chain in the filter table.
I have also used tcpdump to track packets on the host, and observed that in the successful cases i see the packets at the veth* virtual interfaces created by docker, as well as on the docker0 interface.
When doing the NAT to a different interface on IPv6, the packets no longer appear at the docker0 interface, but i still see them at the veth* interface.
