always allow loopback access to forwared ports

cloudfoundry-attic · Oct 30, 2017 · 6fb2608 · 6fb2608
1 parent 80ddd05
commit 6fb2608
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/jobs/port_forwarding/templates/bin/forward_ports.sh.erb b/jobs/port_forwarding/templates/bin/forward_ports.sh.erb
@@ -22,8 +22,7 @@ fi
 
 iptables -F ${CHAIN} || true
 
-# Reset in case when there is no localhost routing
-sysctl net.ipv4.conf.all.route_localnet=0
+sysctl net.ipv4.conf.all.route_localnet=1
 
 <% p("networking.port_forwarding").each do |rule| %>
 	<%
@@ -32,9 +31,10 @@ sysctl net.ipv4.conf.all.route_localnet=0
 		internal_ip   = rule['internal_ip']   || "127.0.0.1"
 		internal_port = rule['internal_port'] || raise("Expected non-empty 'internal_port' on '#{rule.inspect}' rule")
 	-%>
+	# external clients
 	sudo iptables -t nat -A portforwarding-release -p tcp -d <%= external_ip %> --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %>
 
-	<% if internal_ip == "127.0.0.1" %>
-		sysctl net.ipv4.conf.all.route_localnet=1
-	<% end %>
+	# loopback
+	sudo iptables -t nat -A portforwarding-release -p tcp -d 127.0.0.1 --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %> -o lo
+
 <% end %>