nixos forwardports not working for me

[mogorman]

Issue description

I am trying to expose ipfs web admin out over my local network, but when i try to forward the port to localhost where it is listening it doesn't seem to route anything to it. I have worked around the issue by having it listen to the specific interfact i wanted to access it on, but I wasn't sure why this didn't work. attached is my networking.nix file that configuration.nix addresses.

### Steps to reproduce
{ config, lib, pkgs, ... }:
{

  boot.kernel.sysctl = {
    "net.ipv4.conf.all.forwarding" = 1;
    "net.ipv4.conf.default.forwarding" = 1;
  };

  networking.nameservers = [ "127.0.0.1" "8.8.8.8" ];

  networking.nat = {
    enable = true;
    internalIPs = [ "192.168.2.0/24" "192.168.3.0/24" "192.168.4.0/24" ];
    internalInterfaces = [ "enp2s0" "enp3s0" "enp4s0" ];
    externalInterface = "eth0";
    forwardPorts = [
      { destination = "127.0.0.1"; sourcePort = 5001;}
    ];
  };

  networking.firewall = {
     enable = true;
     allowPing = true;
     trustedInterfaces = [ "lo" "enp2s0" "enp3s0" "enp4s0" "tinc.mavericks" ];
     checkReversePath = false;

     allowedTCPPorts = 
       [  22 # ssh
         655 # tinc
        4001 # ipfs
        5001 # ipfs
       ];
     allowedUDPPorts = 
       [
         655 # tinc
       ]; 
   };

  networking.interfaces = {
    eth0 = {
      useDHCP = true;
    };
    enp2s0 = {
      ipAddress = "192.168.2.1";
      prefixLength = 24;
    };
    enp3s0 = {
      ipAddress = "192.168.3.1";
      prefixLength = 24;
    };
    enp4s0 = {
      ipAddress = "192.168.4.1";
      prefixLength = 24;
    };

  };

}

Technical details

#  nixos-version 
17.03.1769.da2159dafb (Gorilla)
# nix-instantiate --eval '<nixpkgs>' -A lib.nixpkgsVersion
"17.03.1769.da2159dafb"
# grep build-use-sandbox /etc/nix/nix.conf
build-use-sandbox = false

[disassembler]

The destination should be in the form <ip address>:<port>.

[mogorman]

i also tried [ { destination = "127.0.0.1:5001"; sourcePort = 5001; } ]

[disassembler]

Just replicated this with mpd. You need to specify that the public interface can route to localnets. Add this to sysctl block: "net.ipv4.conf.eth0.route_localnet" = 1;

[mogorman]

if i set that i can get in via eth0, but not the other interfaces. I tried setting the same but changing the interface but it still doesnt work

[mogorman]

actually i see now that eth0 works even when this isnt set. the internal interfaces dont work no matter what i try

[mogorman]

right, i realize i had it wrong that a destination must have an address and port. i have corrected that and still have a problem

[mogorman]

it looks like with everything set correctly, it will only work on the external interface. Is there a a reason we dont add those other routes here https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/nat.nix#L43

[globin]

A possible option would be to add an interfaces option to the forwardPorts rules.

[flokli]

I also tried getting some port forwarding to work with @zimbatm, and it seems it's still broken. I also couldn't find a NixOS VM test to quickly check this. @wkennington, @volth, could you take a look?

[stale[bot]]

Hello, I'm a bot and I thank you in the name of the community for opening this issue.

To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human.

The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it.

If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use Git blame or GitHub's web interface on the relevant files to find them.

Lastly, you can always ask for help at our Discourse Forum or at #nixos' IRC channel.

[busti]

I had to add the following iptables rule to make it work

networking.firewall.extraCommands = "iptables -t nat -A POSTROUTING -d <destination_ip> -p tcp -m tcp --dport <destination_port> -j MASQUERADE";

works for both tcp and udp

[imincik]

I had to add the following iptables rule to make it work

networking.firewall.extraCommands = "iptables -t nat -A POSTROUTING -d <destination_ip> -p tcp -m tcp --dport <destination_port> -j MASQUERADE";

works for both tcp and udp

@busti , thank you very much. It works for me as well.

My UDP port forwarding configuration is following:

networking = {
    firewall.extraCommands = "iptables -t nat -A POSTROUTING -d 192.168.171.5 -p udp -m udp --dport 1194 -j MASQUERADE";
    nat.forwardPorts = [
      {
        proto = "udp";
        sourcePort = 11194;
        destination = "192.168.171.5:1194";
      }
    ];
}