David Sparks wrote:
According to man iptables: DNAT...In Kernels up to 2.6.10 you can add several --to-destination options. For those kernels, if you specify more than one desti- nation address, either via an address range or multiple --to- destination options, a simple round-robin (one after another in cycle) load balancing takes place between these addresses. Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT tomultiple ranges anymore. I'm wondering why this feature was removed?
I don't have an answer for this, although perhaps others do.
What are the workarounds/alternatives?The reason I ask is that I'm using the range feature to DNAT packets round-robin to 5 machines (.101-.105). .103 just had a hard drive failure and when I went to remove it from the iptables config I find I can't do that anymore as the feature was removed! I've worked around the problem by re-IPing a machine but I'm wondering if there is a iptables solution to this so I'll be better prepared in future?
Here's a workaround that might do what you seek. Optionally, you might consider a DNS-RR instead if it makes sense for your needs.
With the statistic match you can create a round-robin that targets each rule in turn. To do what you seek above you could use this series of rules, with your own additional matches added as required: iptables -A PREROUTING -t nat -m statistic --mode nth --every 2 -j DNAT 10.0.0.101-102
iptables -A PREROUTING -t nat -j DNAT 10.0.0.104-105This is conceptually the same (but simpler than) the following series of rules: iptables -A PREROUTING -t nat -m statistic --mode nth --every 4 -j DNAT 10.0.0.101 iptables -A PREROUTING -t nat -m statistic --mode nth --every 3 -j DNAT 10.0.0.102 iptables -A PREROUTING -t nat -m statistic --mode nth --every 2 -j DNAT 10.0.0.104
iptables -A PREROUTING -t nat -j DNAT 10.0.0.105 Of course, you can continue to add more rules as required. -- Josh
Attachment:
signature.asc
Description: OpenPGP digital signature
