From 5e5dc809cceb971b12286d643bf26c429d476d21 Mon Sep 17 00:00:00 2001 From: Alessandro Boch Date: Mon, 8 Feb 2016 17:32:06 -0800 Subject: [PATCH] Register natChain with portmapper - Becasue it is the only chain which carries the hairpin mode info - Also install the skipDNAT rule only if userland-proxy == true Signed-off-by: Alessandro Boch --- libnetwork/drivers/bridge/setup_ip_tables.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libnetwork/drivers/bridge/setup_ip_tables.go b/libnetwork/drivers/bridge/setup_ip_tables.go index f5ceed2130..16d61588f3 100644 --- a/libnetwork/drivers/bridge/setup_ip_tables.go +++ b/libnetwork/drivers/bridge/setup_ip_tables.go @@ -115,7 +115,7 @@ func (n *bridgeNetwork) setupIPTables(config *networkConfiguration, i *bridgeInt return iptables.ProgramChain(filterChain, config.BridgeName, hairpinMode, false) }) - n.portMapper.SetIptablesChain(filterChain, n.getNetworkBridgeName()) + n.portMapper.SetIptablesChain(natChain, n.getNetworkBridgeName()) } if err := ensureJumpRule("FORWARD", IsolationChain); err != nil { @@ -148,6 +148,9 @@ func setupIPTablesInternal(bridgeIface string, addr net.Addr, icc, ipmasq, hairp if err := programChainRule(natRule, "NAT", enable); err != nil { return err } + } + + if ipmasq && !hairpin { if err := programChainRule(skipDNAT, "SKIP DNAT", enable); err != nil { return err }