fwd_listen_sync_() breaks out of the loop as soon as fwd_sync_one() fails. So, if a single rule fails to bind(), for example because the address isn't assigned to the host, no rule after it in the table is even tried, and those forwards don't work. Reproducer: $ pasta --ns-ifname=tap0 --mtu=65520 --config-net --address=10.0.2.100 \ --netmask=24 --gateway=10.0.2.2 --dns-forward=10.0.2.3 --no-map-gw \ --tcp-ns=none --udp-ns=none --ipv4-only --tcp-ports=none \ --udp-ports=none --conf-path=/tmp/.pasta.sock \ -- python3 -m http.server 80 UNIX domain socket bound at /tmp/.pasta.sock Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... $ pesto -A --tcp-ports=192.0.2.1/8080:80 /tmp/.pasta.sock $ pesto -A --tcp-ports=127.0.0.1/8085:80 /tmp/.pasta.sock $ pesto -s /tmp/.pasta.sock passt/pasta configuration (/tmp/.pasta.sock) HOST TCP [192.0.2.1]:8080 => 80 TCP [127.0.0.1]:8085 => 80 SPLICE $ curl -sS -o /dev/null localhost:8085 curl: (7) Failed to connect to localhost port 8085 after 0 ms: Could not connect to server pasta only reports the failure for port 8080, and never tries to listen on port 8085: Listen failed for HOST TCP port 192.0.2.1/8080: Cannot assign requested address Couldn't listen on requested ports Error switching to new forwarding rules Keep going through the remaining rules if fwd_sync_one() fails, and still return -1 if any of them failed, as before. Signed-off-by: Hayato Kiwata --- fwd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fwd.c b/fwd.c index 5679a3d..6c9df01 100644 --- a/fwd.c +++ b/fwd.c @@ -456,9 +456,8 @@ static int fwd_listen_sync_(void *arg) ns_enter(a->c); for (i = 0; i < a->c->fwd[a->pif]->count; i++) { - a->ret = fwd_sync_one(a->c, a->pif, i, a->tcpmap, a->udpmap); - if (a->ret < 0) - break; + if (fwd_sync_one(a->c, a->pif, i, a->tcpmap, a->udpmap) < 0) + a->ret = -1; } return 0; -- 2.50.1 (Apple Git-155)