DNAT problem

DNAT problem

[Stefan Friedel]

[-- Attachment #1: Type: text/plain, Size: 1243 bytes --]

Good Morning,
I have a problem after switching from an old 2.4.x installation to 2.6.17.3 - scenario:
- computer pool with central server, central server visible in the internet
- several nodes, two of them access nodes, private network
- the two access nodes in the pool get all external ssh connections via a rule on the central server

iptables -t nat -A PREROUTING -p tcp -i eth3 -d <external IP> -j DNAT --dport 22 --to-destination <firstprivip>-<lastprivip>

This worked fine with 2.4.29 (server+nodes). But after switching to 2.6 round
robin is no longer working: only the node <lastprivip> is used. Changing the
rule and using the --to-destination <firstprivip> --to-destination <lastprivip>
does not work at all: iptables is complaining about invalid arguments.

iptables on the server is v1.2.11, Debian sarge, 2.6.17.3

Any hint? Did I miss some changes in the behavior of netfilter/iptables?

Thanks and Regards, Stefan Friedel
-- 
Zentrale Dienste - Interdisziplinäres Zentrum für Wissenschaftliches
Rechnen der Universität Heidelberg - IWR - INF 368, 69120 Heidelberg
stefan.friedel@iwr.uni-heidelberg.de  Tel +49 6221 54-8240 Fax -5224
IWR: www.iwr.uni-heidelberg.de          HELICS: www.helics.uni-hd.de

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: DNAT problem

[Marco Berizzi]

Stefan Friedel wrote:

>Good Morning,

>iptables on the server is v1.2.11, Debian sarge, 2.6.17.3

upgrade to iptables 1.3.6

>Any hint? Did I miss some changes in the behavior of netfilter/iptables?

Man page (from iptables 1.3.6) states:

In Kernels up to 2.6.10 you can add several --to-destination options.
For those kernels, if you specify more than one destination address,
either via an address range or multiple --to-destination options, a
simple round-robin (one after another in cycle)  load  balancing
takes place between these addresses.  Later Kernels (>= 2.6.11-rc1)
don't have the ability to NAT to multiple ranges anymore.

Maybe the SAME target extension will help you.

Re: DNAT problem

[Pascal Hambourg]

Hello,

Marco Berizzi a écrit :
> 
> In Kernels up to 2.6.10 you can add several --to-destination options.
> For those kernels, if you specify more than one destination address,
> either via an address range or multiple --to-destination options, a
> simple round-robin (one after another in cycle)  load  balancing
> takes place between these addresses.  Later Kernels (>= 2.6.11-rc1)
> don't have the ability to NAT to multiple ranges anymore.

OK, SNAT and DNAT do not support multiple --to any more in kernels above 
2.6.10. But it is unclear to me whether they still support one IP 
address *range* (with round robin) or only one single IP address.

> Maybe the SAME target extension will help you.

The SAME target won't do round robin for the same source address. It 
will only do round robin for separate source addresses.

What about the BALANCE target ? It's in the man page, but I had never 
heard of it.

Re: DNAT problem

[Stefan Friedel]

[-- Attachment #1: Type: text/plain, Size: 1301 bytes --]

Hello,
> 
> OK, SNAT and DNAT do not support multiple --to any more in kernels above 
> 2.6.10. But it is unclear to me whether they still support one IP 
> address *range* (with round robin) or only one single IP address.
The range is still accepted as option for iptables 1.3.6, but it has no effect
with 2.6.17.3 (so I assume that it is indeed the "NAT+round robin" capability
which has gone in Kernels > 2.6.10/11). It doesn't matter if I use the SAME or
the DNAT target in PREROUTING -
> 
> The SAME target won't do round robin for the same source address. It 
> will only do round robin for separate source addresses.
> 
> What about the BALANCE target ? It's in the man page, but I had never 
> heard of it.
In iptables 1.3.6 BALANCE is not available (nor is it available in the 2.6.17.3
source). Obsolete? And I fear that it would not help, because the problem is
the missing round robin/load balancing in the Kernel.

Maybe LVS is a solution -

Thanks and Best Regards, Stefan Friedel
-- 
Zentrale Dienste - Interdisziplinäres Zentrum für Wissenschaftliches
Rechnen der Universität Heidelberg - IWR - INF 368, 69120 Heidelberg
stefan.friedel@iwr.uni-heidelberg.de  Tel +49 6221 54-8240 Fax -5224
IWR: www.iwr.uni-heidelberg.de          HELICS: www.helics.uni-hd.de

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: DNAT problem

[Marco Berizzi]

Stefan Friedel wrote:

>Maybe LVS is a solution -

you may also try the nth match (called statistic on linux >=2.6.18)

Re: DNAT problem

[Pascal Hambourg]

Stefan Friedel a écrit :
> 
>>OK, SNAT and DNAT do not support multiple --to any more in kernels above 
>>2.6.10. But it is unclear to me whether they still support one IP 
>>address *range* (with round robin) or only one single IP address.
> 
> The range is still accepted as option for iptables 1.3.6, but it has no effect
> with 2.6.17.3 (so I assume that it is indeed the "NAT+round robin" capability
> which has gone in Kernels > 2.6.10/11). It doesn't matter if I use the SAME or
> the DNAT target in PREROUTING -

One question : did you test this from only one single source IP address 
of from several source IP addresses ? SAME is designed to always give 
the same mapping to a given source address, and it seems that DNAT/SNAT 
do the same in kernels >= 2.6.11.

I remember reading something about this in kernel 2.6.11 changelog :
=======================================================================
   [PATCH] Remove Randomness in Selecting NAT IP Address

   We currently choose a "random" IP address to NAT to, where we have a
   range.  Martin Josefsson pointed out that he uses the SAME target in
   iptables because changing IP addresses breaks Internet banking sites
   (among others) which assume the customer will be coming from a
   consistent IP address.
   In fact, we spend a fair bit of effort trying to balance the number of
   connections we NAT to each IP address.  We can come pretty damn close
   just hashing the source and destination IP addresses, and it has the
   consistency property which is so desirable, as well as being faster.
========================================================================

I believe that with this patch the SNAT and DNAT targets behave in a way 
like the SAME target and always use the same mapping in the --to range 
for a given source IP address. However, when a range is specified, 
different sources may use different mappings. But it won't be a dynamic 
round robin, just a static hash. However I believe that when there are 
many different source addresses it can achieve some kind of load balancing.

>>What about the BALANCE target ? It's in the man page, but I had never 
>>heard of it.
> 
> In iptables 1.3.6 BALANCE is not available (nor is it available in the 2.6.17.3
> source). Obsolete? And I fear that it would not help, because the problem is
> the missing round robin/load balancing in the Kernel.

I don't think so. Each target has its own code.

Re: DNAT problem

[Stefan Friedel]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]

Hello Pascal Hambourg,
> 
> One question : did you test this from only one single source IP address 
> of from several source IP addresses ? SAME is designed to always give 
> the same mapping to a given source address, and it seems that DNAT/SNAT 
> do the same in kernels >= 2.6.11.
ah, great. I just tested a few (3 different source ips, to be honest) accounts
before with SAME - after your last mail I asked some colleagues to test: it is
working indeed (obviously using some statistical method to choose the
destination ip. The destination ip did not change until we opened ~ 10
connections from different source ips...)

Thank you for your hint! and best regards, Stefan Friedel
-- 
Zentrale Dienste - Interdisziplinäres Zentrum für Wissenschaftliches
Rechnen der Universität Heidelberg - IWR - INF 368, 69120 Heidelberg
stefan.friedel@iwr.uni-heidelberg.de  Tel +49 6221 54-8240 Fax -5224
IWR: www.iwr.uni-heidelberg.de          HELICS: www.helics.uni-hd.de

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Cant find

[Joel Lindsay]

Keep getting the error.

iptables v1.2.11: Couldn't find target `MASQUERADE'

Using kernel 2.6.15-uc0 uclinux.

Have compiled as module and statically the following.

iptables support
connection tracking support
ip filter support
reject target support
full nat support
masquerading support

the module ipt_MASQUERADE exists and is loaded, but I keep getting this 
error.  I cant figure out why??

Is there more dependencies on some other modules?


Joel Lindsay, B.Eng
Project Engineer
Waveteq Communications
(250) 766-9229
----- Original Message ----- 
From: "Stefan Friedel" <stefan.friedel@iwr.uni-heidelberg.de>
To: "Pascal Hambourg" <pascal.mail@plouf.fr.eu.org>
Cc: <netfilter@lists.netfilter.org>
Sent: Monday, October 02, 2006 7:18 AM
Subject: Re: DNAT problem

Re: Cant find

[angico]

Try upgrading iptables.
regards,
angico.


--- Joel Lindsay <joel@waveteq.com> wrote:

> Keep getting the error.
> 
> iptables v1.2.11: Couldn't find target `MASQUERADE'
> 
> Using kernel 2.6.15-uc0 uclinux.
> 
> Have compiled as module and statically the following.
> 
> iptables support
> connection tracking support
> ip filter support
> reject target support
> full nat support
> masquerading support
> 
> the module ipt_MASQUERADE exists and is loaded, but I keep getting
> this 
> error.  I cant figure out why??
> 
> Is there more dependencies on some other modules?
> 
> 
> Joel Lindsay, B.Eng
> Project Engineer
> Waveteq Communications
> (250) 766-9229
> ----- Original Message ----- 
> From: "Stefan Friedel" <stefan.friedel@iwr.uni-heidelberg.de>
> To: "Pascal Hambourg" <pascal.mail@plouf.fr.eu.org>
> Cc: <netfilter@lists.netfilter.org>
> Sent: Monday, October 02, 2006 7:18 AM
> Subject: Re: DNAT problem
> 
> 
> 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: DNAT problem

[Marco Berizzi]

Pascal Hambourg wrote:

>The SAME target won't do round robin for the same source address. It will 
>only do round robin for separate source addresses.

You could try with the nth match (it is called statistic match
since 2.6.18, and you need iptables 1.3.6).

>What about the BALANCE target ? It's in the man page, but I had never heard 
>of it.

This is from ipt_SAME.c:

copied ipt_BALANCE.c to ipt_SAME.c and changed a few things.