Broadcast UDP traffic does not reach container via port forwarding

[rgov]

A system on my network broadcasts UDP packets to 10.100.100.255:10600. I run a container with -p 10600:10600/udp intending to receive the traffic.

On Podman with netavark, the traffic is not delivered. The nftables rule includes type local so it ignores broadcast or multicast traffic.

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local jump NETAVARK-HOSTPORT-DNAT
	}

On Docker with docker run --rm -it -p 10600:10600/udp ubuntu:26.04, running socat UDP-LISTEN:10600 -, the packets do get delivered to the container.

Ubuntu 26.04, netavark 1.16.1-3.1, podman 5.7.0+ds2-3build1

[rgov]

I attempted to run socat -u UDP-RECV:10600 UDP-SENDTO:127.0.0.1:10601 to redirect the broadcast to a unicast packet, and then use -p 127.0.0.1:10601:10600/udp to get the packet into the container. This still does not work.

Edit: Claude thinks it's because I end up with a stale conntrack entry after the container restarts. I have to use sysctl -w net.ipv4.conf.all.route_localnet=1 and conntrack -D -p udp --dport 10601... this is pretty arcane.

[Luap99]

I guess broadcast is generally not expected to be forwarded across different subnets?

I have not looked at the docker rules in a while but when we added our nftables rules we copied the prior iptables rules set which originated in the cni plugins so I am not sure if there was ever an explicit decisions for or against broadcast forwarding.

Practically speaking I guess a rootless container would not observe this issue as they bind on the host and proxy in user space but I have no tried to see if pasta has some special handing. And if it works for a rootless container than this is certainly a good argument to make it work for rootful ones as well.