From: Michael Vallaly <netfilter@nolatency.com>
To: GMail Isaac Gonzalez <isaak.gonzalez@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: POSTROUTING SNAT only reply packets
Date: Mon, 17 Jan 2011 17:07:52 -0600 [thread overview]
Message-ID: <20110117170752.a10b99de.netfilter@nolatency.com> (raw)
In-Reply-To: <4D341710.60509@gmail.com>
Have you tried the RAWNAT modules from xtables-addons?
<snip>
iptables -A OUTPUT -s $ORIG_IP -j RAWSNAT --to-source $NEW_IP
</snip>
I've used RAWSNAT in the past, with fairly good success.
-Mike
On Mon, 17 Jan 2011 11:16:48 +0100
GMail Isaac Gonzalez <isaak.gonzalez@gmail.com> wrote:
> Hi,
>
> I need to modify the reply packets of one web server to allow the
> connections between a webserver and client using a load balancer.
>
> The client connections goes to a load balancer, the load balancer
> forwards the connection to a one web server changing the destination ip,
> the web server anwser the client with it's own ip address without
> passing again for the load balancer. In order to stablish the
> connection, the client needs to receive the web server answer with the
> correct ip address (in this case, the load balancer VIP address), in
> other case it receives ACK that it doesn't know about it and the
> connections is not ESTABLISHED.
>
> I've doing some testing and seems that iptables only do SNAT on NEW
> connections, and I need to change the ip address of replied packets.
> Anybody know some workaround? If anobody do not know some workaround can
> you confirm that it's not posible to do this with iptables?
>
> I've tried the next ip tables rules and only work when I do NEW
> connections from the web server.
>
> -A POSTROUTING -o br0 -s WE_SERVER_ADDR -p tcp -m tcp --sport 80 --dport
> 1024:65535 -j SNAT --to-source LOAD_BALANCER_ADDR
>
> Thanks in advance.
>
> Isaac González
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Michael Vallaly <mvallaly@nolatency.com>
next prev parent reply other threads:[~2011-01-17 23:07 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-17 10:16 POSTROUTING SNAT only reply packets GMail Isaac Gonzalez
2011-01-17 10:38 ` Gáspár Lajos
2011-01-17 10:51 ` GMail Isaac Gonzalez
2011-01-17 11:14 ` Amos Jeffries
2011-01-17 10:55 ` Giles Coochey
2011-01-17 11:07 ` GMail Isaac Gonzalez
2011-01-17 11:36 ` Jan Engelhardt
2011-01-17 11:41 ` Giles Coochey
2011-01-17 11:57 ` GMail Isaac Gonzalez
2011-01-17 12:10 ` Jan Engelhardt
2011-01-17 23:07 ` Michael Vallaly [this message]
-- strict thread matches above, loose matches on Subject: below --
2011-01-17 10:15 Isaac González
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110117170752.a10b99de.netfilter@nolatency.com \
--to=netfilter@nolatency.com \
--cc=isaak.gonzalez@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox