From 6fb26080302c3c0a0c71177d7efdf17002ef9648 Mon Sep 17 00:00:00 2001 From: Dr Nic Williams Date: Mon, 30 Oct 2017 16:51:15 +1000 Subject: [PATCH] always allow loopback access to forwared ports --- .../port_forwarding/templates/bin/forward_ports.sh.erb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/jobs/port_forwarding/templates/bin/forward_ports.sh.erb b/jobs/port_forwarding/templates/bin/forward_ports.sh.erb index 8863f71..7d4a6c5 100644 --- a/jobs/port_forwarding/templates/bin/forward_ports.sh.erb +++ b/jobs/port_forwarding/templates/bin/forward_ports.sh.erb @@ -22,8 +22,7 @@ fi iptables -F ${CHAIN} || true -# Reset in case when there is no localhost routing -sysctl net.ipv4.conf.all.route_localnet=0 +sysctl net.ipv4.conf.all.route_localnet=1 <% p("networking.port_forwarding").each do |rule| %> <% @@ -32,9 +31,10 @@ sysctl net.ipv4.conf.all.route_localnet=0 internal_ip = rule['internal_ip'] || "127.0.0.1" internal_port = rule['internal_port'] || raise("Expected non-empty 'internal_port' on '#{rule.inspect}' rule") -%> + # external clients sudo iptables -t nat -A portforwarding-release -p tcp -d <%= external_ip %> --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %> - <% if internal_ip == "127.0.0.1" %> - sysctl net.ipv4.conf.all.route_localnet=1 - <% end %> + # loopback + sudo iptables -t nat -A portforwarding-release -p tcp -d 127.0.0.1 --dport <%= external_port %> -j DNAT --to <%= internal_ip %>:<%= internal_port %> -o lo + <% end %>