Ok,
Thanks for the replies, I was doing some tests to asure the connection
issues. It's compulsory that the load balancer receive the return packets.
El 17/01/11 11:55, Giles Coochey escribió:
On 17/01/2011 11:38, Gáspár Lajos wrote:
Hi,
2011-01-17 11:16 keltezéssel, GMail Isaac Gonzalez írta:
Hi,
I've doing some testing and seems that iptables only do SNAT on NEW
connections, and I need to change the ip address of replied packets.
Anybody know some workaround? If anobody do not know some workaround
can you confirm that it's not posible to do this with iptables?
read again the NAT part in the manual:
man iptables
nat table:
nat:
This table is consulted when a packet that creates
a new connection is encountered. It consists of three built-ins:
PREROUTING (for altering packets as soon as they come in), OUTPUT
(for altering locally-gener-
ated packets before routing), and POSTROUTING (for
altering packets as they are about to go out).
DNAT target:
DNAT
This target is only valid in the nat table, in the
PREROUTING and OUTPUT chains, and user-defined chains which are only
called from those chains. It specifies that the destination address
of the packet should be modified
(and all future packets in this connection will also be
mangled), and rules should cease being examined. It takes one type
of option:
SNAT target:
SNAT
This target is only valid in the nat table, in the POSTROUTING
chain. It specifies that the source address of the packet should be
modified (and all future packets in this connection will also be
mangled), and rules should
cease being examined. It takes one type of option:
I've tried the next ip tables rules and only work when I do NEW
connections from the web server.
-A POSTROUTING -o br0 -s WE_SERVER_ADDR -p tcp -m tcp --sport 80
--dport 1024:65535 -j SNAT --to-source LOAD_BALANCER_ADDR
Thanks in advance.
Isaac González
You should do all of the NAT-ing ON THE LOAD BALANCER:
I have to agree - if you are doing NAT you want to avoid any type of
asymmetric routing - especially you NEED to make sure that the device
that is doing the NAT (be it for load balancing or other reasons)
receives the return packets. You cannot keep a TCP connection going if
there is not some sort of state information being shared between the
devices otherwise.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
