Implemented SNAT support

[chrisnew]

Hello docker community,

instead of masquerade all containers, I implemented the use of masquerade or snat (if exposed port has an IP address) on each container individually. So it's possible to use on a machine with more than just one IPv4 address arbitrary IPv4 addresses individually per container on outgoing connections.

I guess due to the fact that this is my first pull request on docker/libnetwork, there are still some things I need to fix before someone accepts this patch. So please let me know. :)

Cheers

[mort1k]

This can be useful if you want to make a connection within the container to outside. In the case of mapping ip:port:container_port when initiating the connection from the outside, conntrack handles this situation by itself and sends the data is already initiating the connection (and then correct source and destination)

[chrisnew]

Exactly this. I’m sorry I hadn’t the chance lately to check my PR to make it pass the tests. I’m also wondering if it’s now possible to achieve the same effect by using the new networking capabilities in Docker 1.10. I haven’t checked it yet.

[mpalmer]

Any word on the progress of this PR? It would be extremely useful in a circumstance I find myself in at present.

[GordonTheTurtle]

@chrisnew It has been detected that this issue has not received any activity in over 6 months. Can you please let us know if it is still relevant:

• For a bug: do you still experience the issue with the latest version?
• For a feature request: was your request appropriately answered in a later version?

Thank you!
This issue will be automatically closed in 1 week unless it is commented on.
For more information please refer to #1926

[mpalmer]

I don't believe an equivalent of this feature is implemented at present.

[chrisnew]

Unfortunately I’m pretty much out of sync of the current libnetwork development.

The purpose of this PR was to deploy SNAT for any exposed port which is bound to an explicit IPv4. Otherwise masquerading traffic would always stick to the primary IPv4 of the uplink interface.

I had one Docker deployment on a server with multiple IP addresses and I wanted to use for some containers different outgoing IPv4 addreses. Eventually I did a split and did setup separate servers.

However I’m not sure if the newest network stuff in Docker is capable to achieve the same effect using different network definitions and if my stuff will still work flawlessly without breaking more modern features.