Re: POSTROUTING SNAT only reply packets

[GMail Isaac Gonzalez <isaak.gonzalez@gmail.com>]

Ok,

Thanks for the replies, I was doing some tests to asure the connection 
issues. It's compulsory that the load balancer receive the return packets.


El 17/01/11 11:55, Giles Coochey escribió:
> On 17/01/2011 11:38, Gáspár Lajos wrote:
>> Hi,
>>
>> 2011-01-17 11:16 keltezéssel, GMail Isaac Gonzalez írta:
>>> Hi,
>>>
>>
>>> I've doing some testing and seems that iptables only do SNAT on NEW 
>>> connections, and I need to change the ip address of replied packets. 
>>> Anybody know some workaround? If anobody do not know some workaround 
>>> can you confirm that it's not posible to do this with iptables?
>>
>> read again the NAT part in the manual:
>> man iptables
>>
>> nat table:
>>               nat:
>>                   This table is consulted when a packet that creates 
>> a new connection is encountered.  It consists of three built-ins: 
>> PREROUTING (for altering packets as soon as they come in), OUTPUT 
>> (for  altering  locally-gener-
>>                   ated packets before routing), and POSTROUTING (for 
>> altering packets as they are about to go out).
>>
>> DNAT target:
>>
>>    DNAT
>>        This  target  is  only valid in the nat table, in the 
>> PREROUTING and OUTPUT chains, and user-defined chains which are only 
>> called from those chains.  It specifies that the destination address 
>> of the packet should be modified
>>        (and all future packets in this connection will also be 
>> mangled), and rules should cease being examined.  It takes one type 
>> of option:
>>
>> SNAT target:
>>
>>    SNAT
>>        This target is only valid in the nat table, in the POSTROUTING 
>> chain.  It specifies that the source address of the packet should be 
>> modified (and all future packets in this connection will also be 
>> mangled), and rules  should
>>        cease being examined.  It takes one type of option:
>>
>>
>>> I've tried the next ip tables rules and only work when I do NEW 
>>> connections from the web server.
>>>
>>> -A POSTROUTING -o br0 -s WE_SERVER_ADDR -p tcp -m tcp --sport 80 
>>> --dport 1024:65535 -j SNAT --to-source LOAD_BALANCER_ADDR
>>>
>>> Thanks in advance.
>>>
>>> Isaac González
>>>
>>
>> You should do all of the NAT-ing ON THE LOAD BALANCER:
>>
>
> I have to agree - if you are doing NAT you want to avoid any type of 
> asymmetric routing - especially you NEED to make sure that the device 
> that is doing the NAT (be it for load balancing or other reasons) 
> receives the return packets. You cannot keep a TCP connection going if 
> there is not some sort of state information being shared between the 
> devices otherwise.
>