Re: POSTROUTING SNAT only reply packets

["Gáspár Lajos" <swifty@freemail.hu>]

Hi,

2011-01-17 11:16 keltezéssel, GMail Isaac Gonzalez írta:
> Hi,
>

> I've doing some testing and seems that iptables only do SNAT on NEW 
> connections, and I need to change the ip address of replied packets. 
> Anybody know some workaround? If anobody do not know some workaround 
> can you confirm that it's not posible to do this with iptables?

read again the NAT part in the manual:
man iptables

nat table:
               nat:
                   This table is consulted when a packet that creates a 
new connection is encountered.  It consists of three built-ins: 
PREROUTING (for altering packets as soon as they come in), OUTPUT (for  
altering  locally-gener-
                   ated packets before routing), and POSTROUTING (for 
altering packets as they are about to go out).

DNAT target:

    DNAT
        This  target  is  only valid in the nat table, in the PREROUTING 
and OUTPUT chains, and user-defined chains which are only called from 
those chains.  It specifies that the destination address of the packet 
should be modified
        (and all future packets in this connection will also be 
mangled), and rules should cease being examined.  It takes one type of 
option:

SNAT target:

    SNAT
        This target is only valid in the nat table, in the POSTROUTING 
chain.  It specifies that the source address of the packet should be 
modified (and all future packets in this connection will also be 
mangled), and rules  should
        cease being examined.  It takes one type of option:


> I've tried the next ip tables rules and only work when I do NEW 
> connections from the web server.
>
> -A POSTROUTING -o br0 -s WE_SERVER_ADDR -p tcp -m tcp --sport 80 
> --dport 1024:65535 -j SNAT --to-source LOAD_BALANCER_ADDR
>
> Thanks in advance.
>
> Isaac González
>

You should do all of the NAT-ing ON THE LOAD BALANCER:

iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 80 --to-destination 
WEBSERVER1 (some load balancing options here)
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 80 --to-destination 
WEBSERVER2 (some load balancing options here)

iptables -t nat -A POSTROUTING -j SNAT -p tcp --dport 80 -d WEBSERVER1 
--to-source BALANCER_IP_ON_WEBSERVER1_NET
iptables -t nat -A POSTROUTING -j SNAT -p tcp --dport 80 -d WEBSERVER1 
--to-source BALANCER_IP_ON_WEBSERVER2_NET

But some other rules may be in effect....

Swifty