From 55b6ed78898c5633f8a6e4cc2a4bbb511911e3f9 Mon Sep 17 00:00:00 2001
From: Fabian Peter Hammerle <fabian@hammerle.me>
Date: Sat, 15 May 2021 22:52:16 +0200
Subject: [PATCH] entrypoint: create prerouting chain if not already created by
 container runtime

---
 CHANGELOG.md  | 3 +++
 entrypoint.sh | 1 +
 2 files changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9cc2581..ebd761c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
 
 ## [4.3.0] - 2021-05-07
 ### Added
diff --git a/entrypoint.sh b/entrypoint.sh
index 928ac4e..e27762b 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -3,6 +3,7 @@
 set -e
 
 if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
     nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
         || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
     nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \