Re: difference between SNAT and SAME Patch?

[Martin Josefsson <gandalf@wlug.westbo.se>]

On Tue, 2002-09-17 at 10:27, SB CH wrote:
> Hello, all.
> 
> what's the difference of the SNAT and SAME patch?
> 
>  ex)
> 1)iptables -t nat -A POSTROUTING -j SNAT --to-source 1.2.3.4-1.2.3.7
> 2)iptables -t nat -A POSTROUTING -j SAME --to 1.2.3.4-1.2.3.7

SNAT will use the currently least used ip in the range for the new
connection. That means that clients can get diffrent ip's for their
connections, even against the same server and some webservers don't like
this, ie. hotmail, banking via internet....

SAME on the other hand doesn't care which ip has the least number of
connections. It will calculate which ip in the range to use for a given
client, that way a client always gets the same ip on all of it's
connections. I wrote this target when users complained about banking via
internet not working via SNAT with multiple ip's.

(SAME uses both the clients ipadress and the ip of the server you are
trying to connect to in the calculation so by default clients will get
diffrent ip's against diffrent servers but always the same ip against
the same server. There is an option to force it to only care about the
clients ip so that they will always get the same ip regardless of which
server they are trying to connect to, that option is called --nodst,
this is how I use it here)

I hope that helps.

-- 
/Martin

Never argue with an idiot. They drag you down to their level, then beat
you with experience.