Re: -j SNAT

[Danny <dineshg@hostway.com>]

Hey !

Its better you dont disclose the IP of your server, and that the site is 
of a bank !

I think you are better of disconnecting the user, if the client's IP has 
changed ! Or have I understood u wrong !

How have you load balanced ?


Hmm ... NATing incoming requests would not help you in future >> digging 
out access logs and tracking HTTP requests.  !!

You should be using LVS with Direct Routing ! [ with arptables ]  + 
ldirectord  [ Long term solution ]


- Danny

Denis wrote:
> Good afternoon everybody.
>
>
> I'm having a problem with a SNAT and wanna know if somebody here can 
> help-me.
>
>
> the issue is as following:
>
>
> I have a Proxy Load Balanced and when my users try to access bank's
> sites on ssl protocol (port 443)
>
> when the connection  is balanced by the two proxy nodes the bank site
> notes that ip source change and the user is disconnected
>
>
> to solve this problem I thinked to do a SNAT on my two nodes as follow
>
> Node 1 (Ip 202.188.94.66)
>
> iptables -t nat -A POSTROUTING -p tcp -o eth1 --dport 443 -j SNAT
> --to-source 202.188.94.68:6001-7000
>
>
> and on Node 2 (IP 202.188.94.67)
>
> iptables -t nat -A POSTROUTING -p tcp -o eth1 --dport 443 -j SNAT
> --to-source 202.188.94.68:7001-8000
>
> so, the connection arrives on the destination translated as have to
> be, but the connection doesn't get established.
>
> This is as the destination machine can't return the package.
>
>
> Some body have any idea to help me?
>
>