Re: DNAT multiple --to-destination gone: why?

[Josh Cepek <josh.cepek@usa.net>]

[-- Attachment #1: Type: text/plain, Size: 2175 bytes --]

David Sparks wrote:
> According to man iptables:
>
> DNAT...
>               In Kernels up to 2.6.10 you  can  add  several  
> --to-destination
>               options.  For those kernels, if you specify more than 
> one desti-
>               nation address, either via an address range  or  
> multiple  --to-
>               destination  options, a simple round-robin (one after 
> another in
>               cycle) load  balancing  takes  place  between  these  
> addresses.
>               Later  Kernels  (>= 2.6.11-rc1) don't have the ability 
> to NAT to
>               multiple ranges anymore.
>
> I'm wondering why this feature was removed?

I don't have an answer for this, although perhaps others do.

> What are the workarounds/alternatives?
>
> The reason I ask is that I'm using the range feature to DNAT packets 
> round-robin to 5 machines (.101-.105).  .103 just had a hard drive 
> failure and when I went to remove it from the iptables config I find I 
> can't do that anymore as the feature was removed!  I've worked around 
> the problem by re-IPing a machine but I'm wondering if there is a 
> iptables solution to this so I'll be better prepared in future?

Here's a workaround that might do what you seek.  Optionally, you might 
consider a DNS-RR instead if it makes sense for your needs.

With the statistic match you can create a round-robin that targets each 
rule in turn.  To do what you seek above you could use this series of 
rules, with your own additional matches added as required:
iptables -A PREROUTING -t nat -m statistic --mode nth --every 2 -j DNAT 
10.0.0.101-102
iptables -A PREROUTING -t nat -j DNAT 10.0.0.104-105

This is conceptually the same (but simpler than) the following series of 
rules:
iptables -A PREROUTING -t nat -m statistic --mode nth --every 4 -j DNAT 
10.0.0.101
iptables -A PREROUTING -t nat -m statistic --mode nth --every 3 -j DNAT 
10.0.0.102
iptables -A PREROUTING -t nat -m statistic --mode nth --every 2 -j DNAT 
10.0.0.104
iptables -A PREROUTING -t nat -j DNAT 10.0.0.105

Of course, you can continue to add more rules as required.

-- 
Josh



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 197 bytes --]