Problems access instancve ports from browser on local machine

[ilya1st]

is there way make all port of VM accessible on local machine?
E.g. I expose ports of my application but they are accessible only inside vm

It's not good

[ilya1st]

and yes there are problems with kubernetes "opening" nodeports sockets via iptables layer^ that's why sockerts are not visible via sockstat that's why lima-guestagent daemon cannot see them.

[AkihiroSuda]

I guess we need to adjust the regexp here to support kube NodePorts ?

lima/pkg/guestagent/iptables/iptables.go

Lines 20 to 34 in 4edd353

	// This regex can detect a line in the iptables added by portmap to do the
	// forwarding. The following two are examples of lines (notice that one has the
	// destination IP and the other does not):
	//
	// -A CNI-DN-2e2f8d5b91929ef9fc152 -d 127.0.0.1/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 10.4.0.7:80
	// -A CNI-DN-04579c7bb67f4c3f6cca0 -p tcp -m tcp --dport 8082 -j DNAT --to-destination 10.4.0.10:80
	//
	// The -A on the front is to amend the rule that was already created. portmap
	// ensures the rule is created before creating this line so it is always -A.
	// CNI-DN- is the prefix used for rule for an individual container.
	// -d is followed by the IP address. The regular expression looks for a valid
	// ipv4 IP address. We need to detect this IP.
	// --dport is the destination port. We need to detect this port
	// -j DNAT this tells us it's the line doing the port forwarding.
	var findPortRegex = regexp.MustCompile(`-A\s+CNI-DN-\w*\s+(?:-d ((?:\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}))?(?:/32\s+)?-p (tcp)?.*--dport (\d+) -j DNAT`)

[AkihiroSuda]

Opened an issue

• pkg/guestagent/iptables: recognize Kubernetes NodePorts #1021

[ilya1st]

@AkihiroSuda may be. I use kubernetes 1.24 and in uses nftables for forwarding not iptables
In nft ruleset it looks like:

iptables cannot see nft rules