Libvirt port forwarding not working

Maybe related to Connectivity inside LXC container is broken on 15.5 - #8 by RoyBellingan2

This fells like another level of an horror videogame, now the virtual machine gets the ip, dns resolution works ecc, but the port forwarding not!

(Meanwhile the lxc in the trusted are working fine)

The error I receive back is the classical icmp port unreachable, like … somehow data can not be passed to the libvirt zone

The configuration for the firewall is the following

libvirt (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: virbr0
sources:
services: dhcp dhcpv6 dns ssh tftp
ports: 2302/udp 3389/tcp
protocols: icmp ipv6-icmp
forward: yes
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority=“32767” reject

public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client ftp http https mysql ssh
ports: 1022/tcp 5056/tcp 5057/tcp 2302/udp
protocols:
forward: yes
masquerade: yes
forward-ports:
port=5056:proto=tcp:toport=3389:toaddr=192.168.100.223
port=5057:proto=tcp:toport=3389:toaddr=10.110.206.168
source-ports:
icmp-blocks:
rich rules:

trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: lxdbr0
sources:
services:
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

@RoyBellingan2 In the container (I’ve never used LXC), can you check the state of net.ipv6.ip_forward on my k3s/rke vm’s I’v always set to 1 (for ipv4)…

The container is the one inside, maybe you wanted to know the host that is handling it ?

This variable “ip_forward” is only in the ipv4 block, the ipv6 is always bound to a device, so is
net.ipv6.conf.$DEVICE.forwarding.

In any case is always on for all devices, both in the host and the container, and the virtual machine too.

@RoyBellingan2 Ahh ok, I see that for each of my interfaces, but don’t use ipv6 either…

Sounds something like this user https://discuss.linuxcontainers.org/t/lxd-nat-proxy-device-and-port-forwarding/10140/17

So, at the moment I am using socat, which works… but I cry -.-