Re: POSTROUTING SNAT only reply packets

[GMail Isaac Gonzalez <isaak.gonzalez@gmail.com>]

El 17/01/11 12:41, Giles Coochey escribió:
> On 17/01/2011 12:36, Jan Engelhardt wrote:
>> On Monday 2011-01-17 11:55, Giles Coochey wrote:
>>>> You should do all of the NAT-ing ON THE LOAD BALANCER:
>>>>
>>> I have to agree - if you are doing NAT you want to avoid any type of 
>>> asymmetric
>>> routing - especially you NEED to make sure that the device that is 
>>> doing the
>>> NAT (be it for load balancing or other reasons) receives the return 
>>> packets.
>> Not strictly. You could utilize a second device whose CTs are 
>> synchronized
>> with the LB to apply the reverse transform, using conntrackd.
>> Sort of like
>>
>> digraph { internet ->  lb; lb ->  web; web ->  unnat; unnat ->  
>> internet; };
>>
>> but it only looks feasible to me if your LB is already computationally
>> crowded.
>> -- 
> It also requires the loadbalancer to be using netfilter as well.
>
> If it's a hardware load balancer with proprietary methods then you 
> will need symmetric routing through it, unless it supports some form 
> of TCP state sharing.
>
It works with propietary methods. The real solution if do symmetrical 
routing, all the replies must pass through the LB.  I can't use 
conntrackd because I can't install anything in the LB.