From: Chris Frederick <cdf123@cdf123.net>
To: netfilter@vger.kernel.org
Subject: Packets not hitting the nat POSTROUTING table
Date: Thu, 09 Jan 2014 15:57:20 -0600 [thread overview]
Message-ID: <52CF1B40.2070201@cdf123.net> (raw)
Can someone help me understand this issue?
I'm trying to do some load balancing, and nothing seems to be working quite right. The plan would be to have an apache server listening on a
private interface, while the load balancing happens on the public interface using keepalived's virtual address functions. I seem to have
everything setup right, but the apache responses are coming from the private interface.
I've added a TRACE rule to figure out what's happening and none of the response packets are hitting the nat table's POSTROUTING chain.
Everywhere I've found online mentions packet traversal going through nat/POSTROUTING before being sent on.
Here's a flow of what seems to be happening:
Client (A.B.C.D) sends request to load balanced virtual ip (SYN from A.B.C.D to 1.2.3.4)
Keepalived recieves packet and sends it to a mirrored apache (SYN from A.B.C.D to 10.0.0.X)
Apache responds to client (SYN/ACK from 10.0.0.X to A.B.C.D)
Client receives response from unknown source, rightfully discards it (SYN/ACK from 10.0.0.X should have been from 1.2.3.4)
If I could just SNAT the packets with a rule like this:
iptables -t nat -A POSTROUTING -o eth0 -s 10.10.10.0/24 --sport 443 -j SNAT --to 12.34.56.78
I've run similar setups like this before, and they have worked, but I can't figure out why nothing is hitting the POSTROUTING chain in the nat
table.
Any ideas would be helpful.
Chris Frederick
next reply other threads:[~2014-01-09 21:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-09 21:57 Chris Frederick [this message]
2014-01-09 22:31 ` Packets not hitting the nat POSTROUTING table Kristian Evensen
2014-01-09 23:02 ` Chris Frederick
2014-01-10 12:18 ` Kristian Evensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52CF1B40.2070201@cdf123.net \
--to=cdf123@cdf123.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.