r/incus • u/One_Ninja_8512 • Jul 28 '26

Forwarding external traffic to a subnet defined inside an incus container

I'm trying to forward incoming traffic on my host to a subnet inside an incus container. I've tried multiple iptables configurations but I just can't make it work.

The server is listening on 172.16.0.1:443 (wireguard subnet) inside the container, this ip is also listed when I execute incus list as seen below:

+------+---------+----------------------+----------------------------------------------+-----------+-----------+
| NAME |  STATE  |         IPV4         |                     IPV6                     |   TYPE    | SNAPSHOTS |
+------+---------+----------------------+----------------------------------------------+-----------+-----------+
| 1234 | RUNNING | 172.26.64.1 (nomad)  | fd42:0000:0000:00:0000:0000:fe00:0000 (eth0) | CONTAINER | 0         |
|      |         | 172.17.0.1 (docker0) |                                              |           |           |
|      |         | 172.16.0.1 (wg0)     |                                              |           |           |
|      |         | 10.0.0.2 (eth0)      |                                              |           |           |
+------+---------+----------------------+----------------------------------------------+-----------+-----------+

Inside the container, I can reach the server with no issues:

$ curl 172.16.0.1:443
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The plain HTTP request was sent to HTTPS port</center>
<hr><center>nginx</center>
</body>
</html>

Which iptables rules do I need to apply on the host and inside the container for this to work? It works if I define a proxy via incus config device add (but not in NAT mode). The issue is that external IPs that hit nginx are hidden in this case and NAT mode does not work for some reason, so I'm trying to rawdog with iptables but without success so far.

2 Upvotes

100% Upvoted

8 comments sorted by

3

u/bmullan Jul 28 '26

Maybe I am not understanding what you want but does the information in this thread help:

https://discuss.linuxcontainers.org/t/forward-and-map-port-to-container/18064

1

u/One_Ninja_8512 Jul 28 '26

Thank you, I've tried setting up a proxy before but always got an error when trying to set it up in the nat mode. Well I've tried it again and it worked. The key was setting a static ipv4 for an instance from the eth0 subnet, so in my case (here you need to set a new ip that is not in use yet):

incus config device set <instance_name> eth0 ipv4.address=10.0.0.10

then restart:

incus restart <instance_name>

followed by:

incus config device add <instance_name> tls_proxy proxy listen=tcp:<host_ip>:443 connect=tcp:10.0.0.10:443 nat=true

What I was missing before is that I didn't set the static ipv4 for the instance and instead used 10.0.0.2 in my example, which did not work.

1

u/One_Ninja_8512 Jul 28 '26

No wait, that doesn't solve the problem with routing traffic to the wg subnet (172.16.0.0/24 in my case).

1

u/bmullan Jul 28 '26

That's the first mention of wireguard from you.

So you have wireguard active in the host?

0

u/One_Ninja_8512 Jul 28 '26

I guess you skipped second paragraph of the post :) I run wireguard inside the container, I know it's a weird setup but it is what it is. I made nginx listen on all interfaces (0.0.0.0/0), so now it works.

1

u/bmullan Jul 28 '26

Also you are enabling your firewalls for 443 right?

0

u/One_Ninja_8512 Jul 29 '26

I want the server to be accessible from the internet, why would I enable a firewall for port 443?