On Sun, Oct 15, 2023 at 9:04 PM Andrei Borzenkov <arvidjaar(a)gmail.com> wrote:
On 15.10.2023 20:31, Mai Ling wrote:
> 1) Why does the response from api goes to destination being primary IP
> of the host, instead of the IP alias of the web container?
Reply to TCP connection always goes to the source IP address. If
application did not explicitly select specific source IP when
establishing connection, kernel picks up one of suitable addresses. I
suppose kernel simply takes the first address assigned to the interface.
I have no idea how traffic from containers is mapped to the available
addresses, but I am sure firewalld is not involved in this decision.
in podman rootless, pasta is a process spawned when starting the
container. it forwards packets from container network namespace to
host namespace and viceversa.
while it is true that it does not have the ability to choose the
source address, I mentioned there is a nat POSTROUTING rule that
changes the original source IP address into one assigned to traffic
emitted by the user id (the --direct rules I posted). maybe I am not
understanding the kernel flow when traffic is from a local ip to a
local ip, and also a nat involved? I admit it's not a common setup.
Just hoping for an elightenment, even if this is not firewalld's
fault.
> 2) Why does web can initiate outgoing to anywhere?
>
Educated guess - because source address does not match your zone definition.
but the tcpdump shows the source address and the zone definition shows
the same address.