Cannot reach host port / port on pasta Network

[onetr1ck]

Hello. I've got some issue i cannot wrap my head around. Maybe you've got some ideas on how i can troubleshoot this.

I have a nginx based reverse proxy setup with pasta and the following options:
pasta:--map-gw,--ipv4-only,-a,10.0.2.1,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp

Then i've got some containers in the podmans (5.4) default custom (bridge) networks.
One of those containers itself is a frontend, which has a healthcheck function which tries to reach itself via the own public url.
It calls http://example.com, which fails with "Failed to connect..." and "Connection refused".
The url is resolved to the public ip address, which is bound to the reverse proxy in the pasta network.
The url is accessible from other clients and the outside, but not from bridge-network-containers (ping works).
I've logged all firewall-drops, but didnt see any packets dropped matching the dport.

Works:
client -> nginx(pasta, pub. host ip) -> ServiceA(custom network bridge A)

Doesn't work:
ServiceB(custom network Bridge B)-> nginx(pasta, pub. host ip) -> ServiceA(custom network bridge A)

What am I missing?
Thanks.

[Luap99]

see #26502

[onetr1ck]

Your suggested fix was to disable the pasta (no NAT) mode, which I've done according to the options, right?

Also I've tried setting the add-host option, but I use podman-compose, and setting it as option, didn't work there. I'm not sure, if I got right that way. How would I set this in a compose file?

[Luap99]

if you use the bridge networks rootless it works quite different #22943 (comment)

In this case there is only one past aprocess and that only reads options fromt he contianers.conf file as there is no way to set them on the cli. And of course it will only take effect the first time it is started so you would need to make sure to stop all containers first.

As for setting the network argument in compose it is just network_mode: "pasta:--map-gw,--ipv4-only,..." and for hosts it is extra_hosts: AFAIK but podman-compose is a separate project not supported by us the main podman developers so I cannot say much about it.

[onetr1ck]

As for setting the network argument in compose it is just network_mode: "pasta:--map-gw,--ipv4-only,..."

This is what i have done, but there always spawnes a 2nd pasta process with the default options.
Now, when i put the pasta options in the containers.conf, removing them from the docker-compose.yml, killing the containers, restarting podman and killing all pasta processes, i get the following error when trying to start the container again:

/usr/bin/pasta: unrecognized option '--map-guest-addr 10.0.2.1'

But this should be the correct syntax. I'm sry if i got this wrong.
Any hint is appreciated...

[Luap99]

you most likely specified the wrong options in containers.conf, the option is an array so each argument must be comma separated, like this for example

pasta_options = ["--map-guest-addr", "10.0.2.1"]

[onetr1ck]

You're right. Sry. Fixed that. Now the proccesses spawn correctly.
I've just missed, that i have to use the containers.conf.
Thank you so much.