Reverse Proxy Linux Containers
I am trying to set up a reverse proxy on my ubuntu 14.04 host so that I can run multiple websites, each in their own LXC container (one day docker but one step at a time). In this example the sites/hostnames are:
ubuntu1.mydomain.com
ubuntu2.mydomain.com
The containers were created with the names ubuntu1 and ubuntu2.
When I try to set up iptables to forward to these hostnames with the following command:
sudo iptables -t nat -A PREROUTING -d ubuntu1.mydomain.com -j DNAT --to-destination 10.0.3.xxx
(10.0.3.xxx is the ip address of the container on the lxc bridge 10.0.3.1) I get the following error:
iptables v1.4.21: host/network `ubuntu1.mydomain.com' not found
Is there a way to workaround this?
Your approach is flawed. You do not want to use the domain names when configuring iptables
.
Your firewall has no notion of which domain a client has resolved to reach your hostsystem. All it sees are the IP address and port number.
If you want to make the containers reachable via a public IP, you need to choose a distinct IP that is available on the external interface and just
iptables -t nat -A PREROUTING -d <public-ip-for-ubuntu1> -j DNAT --to-destination 10.0.3.xxx
There is literally no way to do this without a designated IP for your container.
If you cannot add such addresses, you can use workarounds of mapping specific ports to other ports in the container, e.g.
iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-destination 10.0.3.xxx:22
to make the container's SSH service available via port 10022
.