Re: DNAT problem

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Stefan Friedel a écrit :
> 
>>OK, SNAT and DNAT do not support multiple --to any more in kernels above 
>>2.6.10. But it is unclear to me whether they still support one IP 
>>address *range* (with round robin) or only one single IP address.
> 
> The range is still accepted as option for iptables 1.3.6, but it has no effect
> with 2.6.17.3 (so I assume that it is indeed the "NAT+round robin" capability
> which has gone in Kernels > 2.6.10/11). It doesn't matter if I use the SAME or
> the DNAT target in PREROUTING -

One question : did you test this from only one single source IP address 
of from several source IP addresses ? SAME is designed to always give 
the same mapping to a given source address, and it seems that DNAT/SNAT 
do the same in kernels >= 2.6.11.

I remember reading something about this in kernel 2.6.11 changelog :
=======================================================================
   [PATCH] Remove Randomness in Selecting NAT IP Address

   We currently choose a "random" IP address to NAT to, where we have a
   range.  Martin Josefsson pointed out that he uses the SAME target in
   iptables because changing IP addresses breaks Internet banking sites
   (among others) which assume the customer will be coming from a
   consistent IP address.
   In fact, we spend a fair bit of effort trying to balance the number of
   connections we NAT to each IP address.  We can come pretty damn close
   just hashing the source and destination IP addresses, and it has the
   consistency property which is so desirable, as well as being faster.
========================================================================

I believe that with this patch the SNAT and DNAT targets behave in a way 
like the SAME target and always use the same mapping in the --to range 
for a given source IP address. However, when a range is specified, 
different sources may use different mappings. But it won't be a dynamic 
round robin, just a static hash. However I believe that when there are 
many different source addresses it can achieve some kind of load balancing.

>>What about the BALANCE target ? It's in the man page, but I had never 
>>heard of it.
> 
> In iptables 1.3.6 BALANCE is not available (nor is it available in the 2.6.17.3
> source). Obsolete? And I fear that it would not help, because the problem is
> the missing round robin/load balancing in the Kernel.

I don't think so. Each target has its own code.