How to forward ports to lxc containers running inside virtualbox vm?

Question

I've got ubuntu/xenial64 VM with port forwarding set up ( config.vm.network "forwarded_port", guest: 80, host: 8080 ). Inside the VM I've created an lxc container ( ubuntu/trusty ), and added iptables rule:

iptables -t nat -A PREROUTING -i lxcbr0 -p tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80

And installed one nginx inside the VM, and one inside lxc container, running inside the VM. From outside the VM I can access nginx running inside the VM, but not the one running inside lxc container. To check I use (outside the VM):

curl -sSv localhost:8080

Or:

w3m http://localhost:8080

How can I tell which one responds? I stop the one running inside the VM, and get no response. But I can access nginx running inside lxc container from inside the VM just fine.

What am I doing wrong (except for running lxc containers inside VM's)? :)

Here's output of iptables-save :

# iptables-save                                                                                   [9/858]
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*mangle
:PREROUTING ACCEPT [293:22775]
:INPUT ACCEPT [261:20343]
:FORWARD ACCEPT [32:2432]
:OUTPUT ACCEPT [174:19243]
:POSTROUTING ACCEPT [206:21675]
-A POSTROUTING -o lxcbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Mon Jul 18 22:04:52 2016
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i lxcbr0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT
# Completed on Mon Jul 18 22:04:52 2016
# Generated by iptables-save v1.6.0 on Mon Jul 18 22:04:52 2016
*filter
:INPUT ACCEPT [256:19487]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [176:19491]
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 67 -j ACCEPT
-A FORWARD -o lxcbr0 -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT
COMMIT
# Completed on Mon Jul 18 22:04:52 2016

Answer 1

It appears, I added rule for the wrong interface. It's supposed to be eth0 , enp0s25 , or whatever corresponds to you physical network interface:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.3.153:80