Reverse Proxy Linux Containers

I am trying to set up a reverse proxy on my ubuntu 14.04 host so that I can run multiple websites, each in their own LXC container (one day docker but one step at a time). In this example the sites/hostnames are:

ubuntu1.mydomain.com
ubuntu2.mydomain.com

The containers were created with the names ubuntu1 and ubuntu2.

When I try to set up iptables to forward to these hostnames with the following command:

sudo iptables -t nat -A PREROUTING -d ubuntu1.mydomain.com -j DNAT --to-destination 10.0.3.xxx

(10.0.3.xxx is the ip address of the container on the lxc bridge 10.0.3.1) I get the following error:

iptables v1.4.21: host/network `ubuntu1.mydomain.com' not found

Is there a way to workaround this?


Your approach is flawed. You do not want to use the domain names when configuring iptables.

Your firewall has no notion of which domain a client has resolved to reach your hostsystem. All it sees are the IP address and port number.

If you want to make the containers reachable via a public IP, you need to choose a distinct IP that is available on the external interface and just

iptables -t nat -A PREROUTING -d <public-ip-for-ubuntu1> -j DNAT --to-destination 10.0.3.xxx

There is literally no way to do this without a designated IP for your container.

If you cannot add such addresses, you can use workarounds of mapping specific ports to other ports in the container, e.g.

iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-destination 10.0.3.xxx:22

to make the container's SSH service available via port 10022.