Re: NAT on stateless firewall ?

[Gregory Carter <gcarter@aesgi.com>]

I think as long as you do not use an INPUT queue, leave it blank and 
make it default accept, you do not need to use state.

Anything requiring an INPUT target though needs state.

-gc

Florin Andrei wrote:
> I need to build a firewall in front of a cluster of HTTP servers. The 
> firewall has 2 interfaces, "inside" (facing the cluster) and "outside" 
> (facing the Internet).
> Each server has a private IP address, so the firewall must translate 
> each server address to a public address on the external interface (I 
> guess that's called 1:1 NAT, it's exactly what a PIX firewall would do 
> via a "static (inside,outside) foobar-out foobar-in netmask 
> 255.255.255.255" statement).
>
> Since HTTP is the only thing traversing the firewall, I don't really 
> need a stateful firewall. In fact, in order to build some redundancy 
> into the firewalling layer, a stateless firewall is even better: I 
> just build 2 or more stateless firewalls and only transfer the IP and 
> MAC if the primary fails - no need to transfer the state.
> Moreover, since the total bandwidth will be very high, that's one more 
> reason to not do stateful filtering (less work for the firewall).
>
> The problem is, NAT seems to imply stateful filtering. The moment I 
> start playing with the nat table, the ip_conntrack module gets loaded.
>
> Questions:
>
> Is there a way to do NAT on a true stateless firewall? (no conntrack 
> loaded)
>
> If the answer to the previous q is negative, can I just ignore 
> conntrack and build the filter and nat tables as if conntrack would 
> not exist? I'm trying to figure out if there's any interaction with 
> conntrack in this scenario, but I don't know netfilter well enough to 
> be 100% sure.
>