Hi,
2011-01-17 11:16 keltezéssel, GMail Isaac Gonzalez írta:
Hi,
I've doing some testing and seems that iptables only do SNAT on NEW
connections, and I need to change the ip address of replied packets.
Anybody know some workaround? If anobody do not know some workaround
can you confirm that it's not posible to do this with iptables?
read again the NAT part in the manual:
man iptables
nat table:
nat:
This table is consulted when a packet that creates a
new connection is encountered. It consists of three built-ins:
PREROUTING (for altering packets as soon as they come in), OUTPUT (for
altering locally-gener-
ated packets before routing), and POSTROUTING (for
altering packets as they are about to go out).
DNAT target:
DNAT
This target is only valid in the nat table, in the PREROUTING
and OUTPUT chains, and user-defined chains which are only called from
those chains. It specifies that the destination address of the packet
should be modified
(and all future packets in this connection will also be
mangled), and rules should cease being examined. It takes one type of
option:
SNAT target:
SNAT
This target is only valid in the nat table, in the POSTROUTING
chain. It specifies that the source address of the packet should be
modified (and all future packets in this connection will also be
mangled), and rules should
cease being examined. It takes one type of option:
I've tried the next ip tables rules and only work when I do NEW
connections from the web server.
-A POSTROUTING -o br0 -s WE_SERVER_ADDR -p tcp -m tcp --sport 80
--dport 1024:65535 -j SNAT --to-source LOAD_BALANCER_ADDR
Thanks in advance.
Isaac González
You should do all of the NAT-ing ON THE LOAD BALANCER:
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 80 --to-destination
WEBSERVER1 (some load balancing options here)
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 80 --to-destination
WEBSERVER2 (some load balancing options here)
iptables -t nat -A POSTROUTING -j SNAT -p tcp --dport 80 -d WEBSERVER1
--to-source BALANCER_IP_ON_WEBSERVER1_NET
iptables -t nat -A POSTROUTING -j SNAT -p tcp --dport 80 -d WEBSERVER1
--to-source BALANCER_IP_ON_WEBSERVER2_NET
But some other rules may be in effect....
Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
