Skip to content
Register

NAT VPS port forwarding: my provider's panel vs manual iptables

VPS Hosting by MeritBudi 17 replies 1.3K views
MeritBudi

Member OP

#1

Already try the NAT VPS from Contabo for my small project. Their panel for port forwarding is exist but have 5 minute delay lah, very annoying dong. I already test manual iptables approach, more fast can or not? This my setup for reference:

iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-destination 10.0.0.2:22

Already working immediate, no need wait panel sync. But the panel will overwrite later or not? Need advice from senior here.

Carl

Member

Rack & Stack

3 #2

I've seen this on Atom C2550 nodes pulling 15W idle. The panel's doing a cron job every 5 minutes, probably hitting a database queue. Your iptables rule will get clobbered on next panel sync unless you hook into their save mechanism.

Check if they use `iptables-persistent` or a custom service. On a 1U Supermicro I racked last month, the provider was using a bash wrapper that diffed against expected state. Manual rules got purged in 300 seconds exactly.

visit twice: install and decom
DealsTallinn

Member

SRE Wannabe

2 #3

`iptables` is cattle not pets, wrap it in `systemd` unit or `ansible` playbook, `kubectl` your way out if they give you `lxc` nested enough for `k3s`.

[Unit]
Description=override Contabo nat
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/fix-nat.sh

`iptables-save` after your rule, diff against `/etc/iptables/rules.v4`, `inotifywait` the panel's file if you want `event-driven` instead of `polling`. `Kubernetes` would handle this with `hostNetwork: true` and `initContainers` but `overkill` for single `NAT` box.

RA

Member

#4

Is this why my website sometimes works and sometimes doesn't? I call CONTABO support and they say everything fine. I think my internet box need more memory, the man at Best Buy said RAM is storage. Should I buy bigger RAM stick or call the nephew again?

mateo_dragon

Member

#5

The panel is tool bad, manual is way good. Is why I prefer the OVHcloud, is immediate the port open. The AWS is same problem with the NAT gateway, cost much money for nothing. ¿Why not¡ use the WireGuard instead the forwarding? Is more simple, server secure. How much cost the IPv4 now, is crazy the price. My VPS small works fine with IPv6 only, but the clients want the IPv4 always, is problem big. I use https://www.wireguard.com for that.

LO

Member

#6

Following this. I have the same 5-minute lag on my Contabo in London, thought it was just me.

Carl

Member

Rack & Stack

#7
DealsTallinn said:
`iptables` is cattle not pets, wrap it in `systemd` unit

That's fighting the provider, not working with them. You'll lose on every kernel update or node migration. I've seen it on three continents.

Better: find their persistence file. On most German hosts it's `/var/lib/contabo/firewall.json` or similar. Touch that and the panel thinks it owns your rule.

https://my.contabo.com

visit twice: install and decom
MeritBudi

Member OP

#8

Carl you genius lah. I check already, found `/var/lib/contabo/nat-rules.json`. I add my port there and restart their `contabo-nat` service, immediate update no 5 minute wait. The JSON format is simple also:

  • {"external_port": 10022, "internal_ip": "10.0.0.2", "internal_port": 22, "protocol": "tcp"}

Thank you senior.

mateo_dragon

Member

#9

OVHcloud have the same file? I search in my VPS but no find. Is different the system maybe.

DealsTallinn

Member

SRE Wannabe

#10
Carl said:
You'll lose on every kernel update or node migration

Node migration on a VPS? That's bare-metal talk. Contabo isn't live-migrating your KVM slice across NUMA nodes, they're rebooting it and calling it maintenance.

The systemd unit is idempotent, survives reboot, costs nothing. `inotifywait` on their JSON is the event-driven middle ground but you're still reverse-engineering undocumented behavior.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft