0

I'm running an xhyve virtual machine (with docker), using a bridged network:

bridge100: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=3<RXCSUM,TXCSUM>
    ether a2:99:9b:01:6d:64
    inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en5 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 12 priority 0 path cost 0
    nd6 options=1<PERFORMNUD>
    media: autoselect
    status: active

I want to forward port 8000 on my mac to the VM IP, port 8000. I am using pfctl:

[~]$ echo "
rdr pass inet proto tcp from any to any port 8000 -> 192.168.64.9 port 8000
" | sudo pfctl -ef -
Password:
pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

No ALTQ support in kernel
ALTQ related functions disabled
pfctl: pf already enabled

Now, telnet to localhost 8000 says "connection refused":

[~]$ telnet localhost 8000
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Network is unreachable
telnet: Unable to connect to remote host

But, telnet to "192.168.64.9" works:

[~]$ telnet 192.168.64.9 8000
Trying 192.168.64.9...
Connected to ebdev.io.
Escape character is '^]'.

How can I forward port 8000 in this case?

1

I've had zero luck with the redirect functionality in pfctl in OS X. Maybe there's something subtle I'm missing, too, but you're not alone. What works for me is ssh port forwarding. It is somewhat less convenient, but it is easy, and always works. Just type:

ssh 127.0.0.1 -L127.0.0.1:8000:192.168.64.9:8000

and as long as that ssh session is active, the port forwarding will be functional. You can leave out "127.0.0.1" if you want to bind the listen socket to all IPs on your machine instead of just binding to localhost.

If you figure out why rdr rules aren't working, let us all know, because you're definitely not the only person seeing this behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.