On 22/02/2011 21:28, Kirk Hoganson wrote:
I am attempting to create a series of rules that source nat web
traffic amongst a pool of IP addresses. I have used the nth mode to
cycle through the IP address in a round robin fashion. I am using the
following rules:
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 0
-j SNAT --to-source 1.104.126.216
Beware that the statistic module counts apply PER rule and not to some
global counter as they used to in earlier versions - this caught me out
before. So with your case, the first rule is matched every 24 packets,
but the second one is matched every 24 packets NOT matched by the
earlier rule, and so on. So any default in your case is much more likely
to happen than you expect.
try doing something like:
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 0
-j SNAT --to-source 1.104.126.x
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 23 --packet 0
-j SNAT --to-source 1.104.126.x
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 22 --packet 0
-j SNAT --to-source 1.104.126.x
The same applies with random, you need to reduce the probability based
on the chance of it being hit, eg:
.25, .33, .50, 1
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
