In an environment of Secured Virtual Private Clouds, in a Cluster of Docker Containers, we have to setup some routes.

We can do that with the Ambassador pattern, which is simple and easy to maintain. (Docker does have some usage of IPTables under the hood - but from what I can see the Ambassador pattern uses socat, and not IPTables to achieve its forwarding.

We can setup NAT rules with IPTables to achieve a similar goal.

My question is: When would I choose IPTables over an Ambassador pattern for port forwarding?

1 Answer 1


iptables will probably scale better than socat because socat runs completely in user space. There's a common impression that iptables is hard to deal with, but I find it easier that most routers to fiddle with. There are a number of iptables wrappers available to make it easier to handle.

If you're willing to accept the performance hit of running in user space then consider haproxy over socat because it is intended to run over longer periods and provides statistics, failover, SSL termination, and lots of other conveniences.

  • Great thinking - in terms of user maintainability - would you say that socat or iptables are more 'self-documenting' for other people to understand?
    – hawkeye
    Commented May 31, 2017 at 12:26
  • I'd say the configs for haproxy are easiest to follow. Then iptables is likely to be used for more complex things than socat and easier to maintain.
    – chicks
    Commented May 31, 2017 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.