Selfhosted

41837 readers

580 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

[email protected]

[Question] Does this iptables rule cause unnecessary routing? (self.selfhosted)

submitted 1 day ago by Statick to c/[email protected]

8 comments fedilink hide all child comments

I'm routing game traffic on my VPS via wireguard to a home server that has games hosted via docker.

Setup is...

VPS/Wireguard -> Internet -> Wireguard/Dockerized Games Server

Now, my current config WORKS... however I'm curious if there is some unnecessary routing going on.

VPS iptable rules (omitted PostDown)

PostUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 61000:61100 -j DNAT --to-destination 10.0.0.3
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Game Server (omitted PostDown)

Here are the iptable rules on the game server and the --to-destination part is what I'm curious about...

PostUp = iptables -t nat -A PREROUTING -p tcp --dport 61000:61100 -d 10.0.0.3 -j DNAT --to-destination 192.168.1.14
PostUp = iptables -t nat -A POSTROUTING -j MASQUERADE

10.0.0.3 is the same machine as 192.168.1.14

The reason I'm setting the --to-destination ip to that is because the docker rules that are created in the Chain DOCKER section of the iptable rules are looking for the destination nam-games.localdomain which is my dns entry for the game server. I unfortunately don't think I can change these because I'm using a game server management panel called Pterodactyl that adds these. I also don't want to have to manually add rules to this every time I create a server.

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere
DNAT       tcp  --  anywhere             nam-games.localdomain  tcp dpt:61000 to:172.18.0.2:61000
DNAT       udp  --  anywhere             nam-games.localdomain  udp dpt:61000 to:172.18.0.2:61000
DNAT       tcp  --  anywhere             nam-games.localdomain  tcp dpt:61001 to:172.18.0.3:61001
DNAT       udp  --  anywhere             nam-games.localdomain  udp dpt:61001 to:172.18.0.3:61001

Concerns

The setup I described above is the only config I have gotten to work, but I'm curious if it's hitting the server, then going the router, only to be routed back to the same machine again. If it is, is there a better way to set this up?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 19 hours ago (1 children)

No v4/v6 dual stack mentioned here, nor any multi-action rules required, so nftables would be of no advantage here.

Unless you're just saying "new thing good, old thing bad" here, I'm not sure why bother mentioning nftables.

[–] [email protected] 1 points 16 hours ago (1 children)

Nah, I am saying good new things, good old things, why not take the opportunity to migrate? Its fun.

[–] [email protected] 3 points 14 hours ago

Because bringing up nftables is not relevant to op's question.