I need to build a firewall in front of a cluster of HTTP servers. The
firewall has 2 interfaces, "inside" (facing the cluster) and "outside"
(facing the Internet).
Each server has a private IP address, so the firewall must translate
each server address to a public address on the external interface (I
guess that's called 1:1 NAT, it's exactly what a PIX firewall would do
via a "static (inside,outside) foobar-out foobar-in netmask
255.255.255.255" statement).
Since HTTP is the only thing traversing the firewall, I don't really
need a stateful firewall. In fact, in order to build some redundancy
into the firewalling layer, a stateless firewall is even better: I just
build 2 or more stateless firewalls and only transfer the IP and MAC if
the primary fails - no need to transfer the state.
Moreover, since the total bandwidth will be very high, that's one more
reason to not do stateful filtering (less work for the firewall).
The problem is, NAT seems to imply stateful filtering. The moment I
start playing with the nat table, the ip_conntrack module gets loaded.
Questions:
Is there a way to do NAT on a true stateless firewall? (no conntrack loaded)
If the answer to the previous q is negative, can I just ignore conntrack
and build the filter and nat tables as if conntrack would not exist? I'm
trying to figure out if there's any interaction with conntrack in this
scenario, but I don't know netfilter well enough to be 100% sure.
--
Florin Andrei
http://florin.myip.org/
