lxc port forwarding doesn't work

[onsails]

My lima guest is ubuntu-lts with lxd installed via snap.
br_netfilter module is enabled.
I have an instance with ssh running on port 22. Instance ip is 10.127.122.108 and I can connect to it from lima guest via ssh 10.127.122.108 -p 22

Set up port forwarding via

lxc network forward create lxdbr0 127.0.0.1
lxc network forward port add lxdbr0 127.0.0.1 tcp 2222 10.127.122.108 22

then ssh localhost -p 2222 doesn't connect (not refuses, just stuck connecting).

journalctl -f:

Jan 10 22:56:09 lima-lxd audit[15483]: NETFILTER_CFG table=lxd:16 family=1 entries=12 op=nft_register_chain pid=15483 subj=unconfined comm="nft"
Jan 10 22:56:09 lima-lxd audit[15483]: SYSCALL arch=c00000b7 syscall=211 success=yes exit=2376 a0=3 a1=ffffd5094cd0 a2=0 a3=ffffbbea4880 items=0 ppid=4553 pid=15483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nft" exe="/snap/lxd/23545/bin/nft" subj=unconfined key=(null)
Jan 10 22:56:09 lima-lxd audit: PROCTITLE proctitle=6E6674000A616464207461626C6520696E6574206C78640A61646420636861696E20696E6574206C78642066776470726572742E6C7864627230207B74797065206E617420686F6F6B20707265726F7574696E67207072696F72697479202D3130303B20706F6C696379206163636570743B7D0A61646420636861696E20696E
Jan 10 22:56:09 lima-lxd kernel: audit: type=1325 audit(1673391369.517:996): table=lxd:16 family=1 entries=12 op=nft_register_chain pid=15483 subj=unconfined comm="nft"
Jan 10 22:56:09 lima-lxd kernel: audit: type=1300 audit(1673391369.517:996): arch=c00000b7 syscall=211 success=yes exit=2376 a0=3 a1=ffffd5094cd0 a2=0 a3=ffffbbea4880 items=0 ppid=4553 pid=15483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nft" exe="/snap/lxd/23545/bin/nft" subj=unconfined key=(null)
Jan 10 22:56:09 lima-lxd kernel: audit: type=1327 audit(1673391369.517:996): proctitle=6E6674000A616464207461626C6520696E6574206C78640A61646420636861696E20696E6574206C78642066776470726572742E6C7864627230207B74797065206E617420686F6F6B20707265726F7574696E67207072696F72697479202D3130303B20706F6C696379206163636570743B7D0A61646420636861696E20696E

root@lima-lxd:~# nft list ruleset
table ip nat {
        chain PREROUTING {
                type nat hook prerouting priority dstnat; policy accept;
                meta l4proto udp ip daddr 192.168.5.3 udp dport 53 counter packets 0 bytes 0 dnat to 192.168.5.2:62483
                meta l4proto tcp ip daddr 192.168.5.3 tcp dport 53 counter packets 0 bytes 0 dnat to 192.168.5.2:54084
        }

        chain OUTPUT {
                type nat hook output priority -100; policy accept;
                meta l4proto udp ip daddr 192.168.5.3 udp dport 53 counter packets 50 bytes 3256 dnat to 192.168.5.2:62483
                meta l4proto tcp ip daddr 192.168.5.3 tcp dport 53 counter packets 0 bytes 0 dnat to 192.168.5.2:54084
        }
}
table inet lxd {
        chain pstrt.lxdbr0 {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 10.127.122.0/24 ip daddr != 10.127.122.0/24 masquerade
                ip6 saddr fd42:7ad:f0f2:3a91::/64 ip6 daddr != fd42:7ad:f0f2:3a91::/64 masquerade
        }

        chain fwd.lxdbr0 {
                type filter hook forward priority filter; policy accept;
                ip version 4 oifname "lxdbr0" accept
                ip version 4 iifname "lxdbr0" accept
                ip6 version 6 oifname "lxdbr0" accept
                ip6 version 6 iifname "lxdbr0" accept
        }

        chain in.lxdbr0 {
                type filter hook input priority filter; policy accept;
                iifname "lxdbr0" tcp dport 53 accept
                iifname "lxdbr0" udp dport 53 accept
                iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
                iifname "lxdbr0" udp dport 67 accept
                iifname "lxdbr0" icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } accept
                iifname "lxdbr0" udp dport 547 accept
        }

        chain out.lxdbr0 {
                type filter hook output priority filter; policy accept;
                oifname "lxdbr0" tcp sport 53 accept
                oifname "lxdbr0" udp sport 53 accept
                oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
                oifname "lxdbr0" udp sport 67 accept
                oifname "lxdbr0" icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } accept
                oifname "lxdbr0" udp sport 547 accept
        }

        chain fwdprert.lxdbr0 {
                type nat hook prerouting priority dstnat; policy accept;
                ip daddr 127.0.0.1 tcp dport 2222 dnat ip to 10.127.122.108:22
        }

        chain fwdout.lxdbr0 {
                type nat hook output priority -100; policy accept;
                ip daddr 127.0.0.1 tcp dport 2222 dnat ip to 10.127.122.108:22
        }

        chain fwdpstrt.lxdbr0 {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 10.127.122.108 ip daddr 10.127.122.108 tcp dport 22 masquerade
        }
}

[AkihiroSuda]

Unsupported, as the port forward detection is currently hardcoded for CNI

lima/pkg/guestagent/iptables/iptables.go

Lines 20 to 34 in 45ca822

	// This regex can detect a line in the iptables added by portmap to do the
	// forwarding. The following two are examples of lines (notice that one has the
	// destination IP and the other does not):
	//
	// -A CNI-DN-2e2f8d5b91929ef9fc152 -d 127.0.0.1/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 10.4.0.7:80
	// -A CNI-DN-04579c7bb67f4c3f6cca0 -p tcp -m tcp --dport 8082 -j DNAT --to-destination 10.4.0.10:80
	//
	// The -A on the front is to amend the rule that was already created. portmap
	// ensures the rule is created before creating this line so it is always -A.
	// CNI-DN- is the prefix used for rule for an individual container.
	// -d is followed by the IP address. The regular expression looks for a valid
	// ipv4 IP address. We need to detect this IP.
	// --dport is the destination port. We need to detect this port
	// -j DNAT this tells us it's the line doing the port forwarding.
	var findPortRegex = regexp.MustCompile(`-A\s+CNI-DN-\w*\s+(?:-d ((?:\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}))?(?:/32\s+)?-p (tcp)?.*--dport (\d+) -j DNAT`)