On Tuesday 16 September 2008 00:24:38 Joseph Mack NA3T wrote: > On Mon, 15 Sep 2008, Simon Horman wrote: > > > Well, it would be a problem if it gets DNATed a second time. > > Are you just being really safe? Are you trying to prevent > someone from adding DNAT rules to OUTPUT? > > Would it be better (as much as possible) for LVS to appear > to be just another netfilter module, in which case if > someone wants to DNAT in OUTPUT, this should be allowed > (whether it's sensible or not). Currently LVS-NAT doesn't > allow SNAT on OUTPUT, which no-one thought about when > LVS-NAT was first written and it turns out to be useful. For what it's worth, I'm currently using DNAT alongside LVS-NAT for certain connections. It only serves a secondary purpose and there are other ways (although not as simple) to achieve the purpose, but it has proven useful. -- Jason Stubbs <j.stubbs@xxxxxxxxxxxxxxx> LINKTHINK INC. 東京都渋谷区桜ヶ丘町22-14 N.E.S S棟 3F TEL 03-5728-4772 FAX 03-5728-4773 -- To unsubscribe from this list: send the line "unsubscribe lvs-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
