Subject: Re: [vserver] iptables rules for lo interface in guest
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 29 Sep 2009 21:49:32 +0200

On Wed, Sep 30, 2009 at 06:42:16AM +1200, Michael wrote:
> Hi All,

> previous install on xen was using iptables to redirect posgreslq port
> ( 5631) to different port :
> -A PREROUTING -p tcp -m tcp --dport 5631 -j REDIRECT --to-ports 5666
> -A OUTPUT -p tcp -m tcp --dport 5631 -j REDIRECT --to-ports 5666

this one 'redirects' a request to 5631 (no idea why in
prerouting and output) to port 5666 unconditionally
(i.e. for all outgoing requests)

> when migrated to virtual server use rules on host to redirect port:
> -A PREROUTING -d $EXTIP/32 -i eth0 -p tcp -m tcp --dport 5631 -j DNAT
> --to-destination $GEUSTIP:5666

you are now trying to DNAT? an outgoing (routed)
request to a different port on a potential local?
IP ... doesn't really make sense to me ...

> which working OK for any outside access but not for localhost in guest.
> so I am a bit confuse how properly apply iptabels on host so it will
> work for lo in guest?

I doubt, remapping affected the 'localhost' in
your Xen setup ....

> Tried  tcpdump  - it will show like guest ip like 127.111.0.1 applying
> it as source or dst in iptabels doesn't help.

depends on what rules you have ... it would be 
helpful if you could describe what you are actually
trying to accomplish ....

best,
Herbert

> -- 
> --
> Michael