NAT on stateless firewall ?

[Florin Andrei <florin@andrei.myip.org>]

I need to build a firewall in front of a cluster of HTTP servers. The 
firewall has 2 interfaces, "inside" (facing the cluster) and "outside" 
(facing the Internet).
Each server has a private IP address, so the firewall must translate 
each server address to a public address on the external interface (I 
guess that's called 1:1 NAT, it's exactly what a PIX firewall would do 
via a "static (inside,outside) foobar-out foobar-in netmask 
255.255.255.255" statement).

Since HTTP is the only thing traversing the firewall, I don't really 
need a stateful firewall. In fact, in order to build some redundancy 
into the firewalling layer, a stateless firewall is even better: I just 
build 2 or more stateless firewalls and only transfer the IP and MAC if 
the primary fails - no need to transfer the state.
Moreover, since the total bandwidth will be very high, that's one more 
reason to not do stateful filtering (less work for the firewall).

The problem is, NAT seems to imply stateful filtering. The moment I 
start playing with the nat table, the ip_conntrack module gets loaded.

Questions:

Is there a way to do NAT on a true stateless firewall? (no conntrack loaded)

If the answer to the previous q is negative, can I just ignore conntrack 
and build the filter and nat tables as if conntrack would not exist? I'm 
trying to figure out if there's any interaction with conntrack in this 
scenario, but I don't know netfilter well enough to be 100% sure.

-- 
Florin Andrei

http://florin.myip.org/