Re: [LARTC] Load Balance and SNAT problem.

[VladSun <vladsun@relef.net>]

John Chang написа:
>
> I am developing load balancing router, But I have a question about 
> fail over.
> The follow diagram is my test environment and scripts.
> -------------------------------------------------------------------
> Environment Setting
>
> PC1(192.168.10.2 <http://192.168.10.2>)
> |
> (LAN)
> |
> PC2-eth2( 192.168.10.1 <http://192.168.10.1>)
> + +
> PC2-eth0(111.111.111.2 <http://111.111.111.2>) PC2-eth1(222.222.222.2 
> <http://222.222.222.2> )
> | |
> (WAN1) (WAN2)
> | |
> PC3-eth0(111.111.111.1 <http://111.111.111.1>) PC3-eth1( 222.222.222.1 
> <http://222.222.222.1>)
> + +
> PC2-eth2(172.16.0.1 <http://172.16.0.1>)
>
> PC2-Linux Kernel 2.6.21
> PC2-Iptables 1.3.7
>
>
> -------------------------------------------------------------------
> Iptables rules:
>
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 111.111.111.2 
> <http://111.111.111.2>
> iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 222.222.222.2 
> <http://222.222.222.2>
>
> # table 101
> ip route flush table 101
> ip route add 192.168.10.0/24 <http://192.168.10.0/24> dev eth2 table 101
> ip route add default via 111.111.111.1 <http://111.111.111.1> dev eth0 
> table 101
>
> # table 102
> ip route flush table 102
> ip route add 192.168.10.0/24 <http://192.168.10.0/24> dev eth2 table 102
> ip route add default via 222.222.222.1 <http://222.222.222.1> dev eth1 
> table 102
>
> ip rule del fwmark 1 table 101
> ip rule del fwmark 2 table 102
> ip rule add fwmark 1 table 101
> ip rule add fwmark 2 table 102
>
> iptables -t mangle -A PREROUTING -t mangle -j CONNMARK --restore-mark
> iptables -t mangle -A PREROUTING -m state --state NEW -m statistic 
> --mode nth --every 2 --packet 1 -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -m state --state NEW -m statistic 
> --mode nth --every 2 --packet 2 -j MARK --set-mark 2
> iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
>
> -----------------------------------------------------------------------------
>
Well ... I am not sure about it but you may try to do it this way:

iptables -t nat -A POSTROUTING -o ! eth2 -m mark --mark 1 -j SNAT --to 
111.111.111.2 <http://111.111.111.2>
iptables -t nat -A POSTROUTING -o ! eth2 -m mark --mark 2 -j SNAT --to 
222.222.222.2 <http://222.222.222.2>

iptables -t mangle -A PREROUTING -t mangle -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m state --state NEW -m statistic 
--mode nth --every 2 --packet 1 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -m statistic 
--mode nth --every 2 --packet 2 -j MARK --set-mark 2
iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark


This is done without using iproute.
There is another solution, but it works only with kernels up to 2.6.10:

iptables -t nat -A POSTROUTING -o ! eth2 -j SNAT --to 111.111.111.2 
<http://111.111.111.2>,222.222.222.2 <http://222.222.222.2>

".... For those kernels, if you specify more than one source
address, either via an address range or multiple --to-source options, a 
simple round-robin (one after another in cycle) takes
place between these addresses. Later Kernels (>= 2.6.11-rc1) don't have 
the ability to NAT to multiple ranges anymore. ..."
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc