On 04/22/08 10:10, Javier Prieto Martínez wrote:
Well.. I don't speak English very well, so it's easy to misunderstand my
posts :-)
That's ok. You are doing just fine. :)
In your graph, "S" is my LAN with my all my servers and local
workstations. When I say that "I don't want to mess with the real IPs",
I mean I don't want to make any change within my LAN.
*nod*
Just to make sure that I understand you correctly, you do not want to
have to re-configure IP addresses on servers when you add or remove the
appliance but you do not care if a given server sees the traffic as
being to its self rather than the original address. I.e.
C -> S1 (client sends traffic)
C -> S1 (router routes traffic)
C -> S1 (appliance receives traffic)
C -> S2 (and changes it to S2 )
C -> S2 (server 2 receives traffic)
S2 -> C (server 2 replies to traffic)
S2 -> C (appliance receives traffic)
S1 -> C (and changes it to S1 )
S1 -> C (router routes traffic)
S1 -> C (client receives traffic)
The key point is that S2 sees the traffic as being to (destination IP)
its self, rather than to S1.
If this is ok with you, then DNATing / SNATing will work just fine.
The point of the redirection is that, when I need to make a change in
one of my servers, I'd like my appliance to redirect all the traffic
coming from the extranet ("C") to another server. For example, if I have
to stop the web server while upgrading, I'd like all the traffic coming
from outside to reach another web server with a catched version of my
web page.
*nod*
The proccess should be something like that:
* C starts a connection to S1, port 80
* R routes that packet to my LAN
* A captures that packet, and changes the destintation to S2, port 80
* S2 generates a response to C
* A captures that packet, and changes its source to S1, port 80
* R routes that packet to the outside network
* C gets a packet from S1, port 80
*nod*
I'm making some tests with EBTables in my lab enviroment.
I'll tell you the results.
Ok. Let me know if you need any thing else.
Remember that you will need to DNAT the inbound traffic and SNAT the
outbound traffic too.
Also, if you are redirecting the traffic (originally to the downed
server) to another up and functioning server, you have to be careful not
to interfere with the other servers normally functioning traffic.
You can very simply write an EBTables rule to SNAT the traffic as it
passes through the appliance. However you have to make sure that you
only SNAT the traffic that was originally DNATed and not all the traffic
from S2.
Thanks a lot.
You are welcome.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
