I have Ethernet on my machine (enp0s10) that connected to real network,and I have lxcbr0 Ethernet bridge which gather lxc containers.And I want to make available one  of lxc containers.So I wrote:IFACE=enp0s10echo allow inet for lxciptables -t nat -A POSTROUTING -o $IFACE -j MASQUERADEiptables -A FORWARD -i $IFACE -o lxcbr0 -m state --state RELATED,ESTABLISHED -j ACCEPTiptables -A FORWARD -i lxcbr0 -o $IFACE -j ACCEPTecho allow web for lxciptables -A PREROUTING -t nat -i $IFACE -p tcp --dport 19980 -j DNAT --to 172.20.0.5:80iptables -A INPUT -p tcp -m state --state NEW --dport 19980 -i $IFACE -j ACCEPTThe first set of rules configure internet inside lxc container,and the second set make possible to connect web server inside lxc container,if I use url http://machine-ip:19980. All works. But then I want make it more secure and end rules with:iptables -N logdropiptables -A logdrop -m limit --limit 5/m --limit-burst 10 -j LOGiptables -A logdrop -j DROPiptables -A INPUT -p tcp -m state --state NEW -j logdropiptables -A INPUT -j logdropiptables -A FORWARD -j logdropSo I log and drop all that I not allow in explicit way.After that I got in logs:IN=enp0s10 OUT=lxcbr0 MAC=xxx SRC=192.168.1.1 DST=172.20.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=57331 DF PROTO=TCP SPT=58432 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 So I not allow something and packet stop on the way from enp0s10 to lxcbr0,but what exactly I missed and what need to fix?
lxc container  external internet, what I missed?
iptables;port forwarding;nat;forwarding
Found here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-firewall-ipt-fwd.htmlIf you have a default policy of DROP in your FORWARD chain, you must  append a rule to allow forwarding of incoming HTTP requests so that  destination NAT routing can be possible. To do this, run the following  command: iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 172.31.0.23 -j ACCEPT