Access lxc container services from other lxc containers via host

Question

I've got a laptop with Ubuntu 14 Desktop. The laptop has WLAN connection to my LAN and is managed by network manager. Of cause, the laptop a nic (eth0), too, but it is not connected. I use this laptop as an LXC-host. I've got multiple containers serving applications. With the basic setup of LXC (default settings like using dnsmasq, bridged network).

The output of ifconfig is showing 4 interfaces: eth0, lo, wlan and lxcbr0. So far, there is no special iptables configuration done, yet. It is a fresh installed system

Now, by configuring NAT on my LXC-host...

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 21404 -j DNAT --to 10.0.3.180:3142

... I'm able to access services in my containers, when accessing from another machine in my LAN, for example:

foo@LANMachine2: wget -O - http://lxc-host:21404 #it works

Hint: lxc-host is a DNS name for the laptop managed by my router.

Now what I want to do is, is to stay on my machine and to access a container's service from the LXC-host itself and other hosted containers using the same DNS name, like that:

bar@lxc-host: wget -O - http://lxc-host:21404 
#or
bar@lxc-container: wget -O - http://lxc-host:21404

#both not working and leading to output:
Connecting to lxc-host (lxc-host)|The.IP.shown.here|:21404... failed: Connection refused.

How to get this working? Is it possible, at all? Most import for me would be to be able to connect from other containers to other containers' services by routing through the LXC-host. (This would allow me to standardize my containers' setup)

Answer 1

Packets from the same host never reach the PREROUTING table (or any other nat table), as they are not routed from one interface to another.

For container-to-container networking, you can either use a shared bridge (which does not need to be the same as they share with the host) or actually use routing and the PREROUTING iptables table, if they are on different interfaces.