Query on nftables DNAT for localhost-to-localhost traffic in IPv6 or without route_localnet

Antonio Ojea <[email protected]> Fri, 1 Aug 2025 00:59:15 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <CABhP=tbrKeaQCAnKHbJoWNcgTthvmAEPEOcvux_W8eztR5QT1Q@mail.gmail.com>
Hi,

We (kubernetes) are currently exploring options for port forwarding
traffic that originates from localhost and is also destined for
localhost, to redirect it to a different destination IP address and
port [1].

We can use the route_localnet sysctl parameter, however, that does not
work for IPv6.

We are trying to avoid solutions that rely on eBPF or userspace
proxies to reduce the maintenance load, and hoping to find a solution
within the kernel's networking stack.

Any guidance or suggestions you could provide would be greatly appreciated.

[1]: https://github.com/kubernetes/kubernetes/issues/132955