From: Kirk Hoganson <kirkhoganson@gmail.com>
To: netfilter@vger.kernel.org
Subject: Round Robin or Random Source NATing
Date: Thu, 17 Feb 2011 22:38:49 -0800 [thread overview]
Message-ID: <4D5E13F9.1050608@gmail.com> (raw)
I am attempting to create a series of rules that source nat web traffic
amongst a pool of IP addresses. I have used the nth mode to cycle
through the IP address in a round robin fashion. I am using the
following rules:
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 0
-j SNAT --to-source 1.104.126.216
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 1
-j SNAT --to-source 1.104.126.217
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 2
-j SNAT --to-source 1.104.126.218
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 3
-j SNAT --to-source 1.104.126.219
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 4
-j SNAT --to-source 1.104.126.220
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 5
-j SNAT --to-source 1.104.126.221
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 6
-j SNAT --to-source 1.104.126.222
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 7
-j SNAT --to-source 1.104.126.223
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 8
-j SNAT --to-source 1.104.126.224
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 9
-j SNAT --to-source 1.104.126.225
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 10
-j SNAT --to-source 1.104.126.226
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 11
-j SNAT --to-source 1.104.126.227
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 12
-j SNAT --to-source 1.104.126.228
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 13
-j SNAT --to-source 1.104.126.229
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 14
-j SNAT --to-source 1.104.126.230
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 15
-j SNAT --to-source 1.104.126.231
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 16
-j SNAT --to-source 1.104.126.232
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 17
-j SNAT --to-source 1.104.126.233
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 18
-j SNAT --to-source 1.104.126.234
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 19
-j SNAT --to-source 1.104.126.235
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 20
-j SNAT --to-source 1.104.126.236
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 21
-j SNAT --to-source 1.104.126.237
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 22
-j SNAT --to-source 1.104.126.238
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 23
-j SNAT --to-source 1.104.126.239
At first glance the rules appear to work. However when I look at the
traffic on the receiving host, I see a number of connections from the
primary eth0 address of the source system. I see approximately 10x as
many connections from the primary IP address (which isn't in the round
robin rotation) as I do from any of the addresses in the round robin
pool. The addresses in the pool all have approximately the same number
of connections to the remote host.
How can I create a round robin, or random source nat pool for web
connections, without using the primary IP address of the source system
to connect to the remote host?
Thanks.
next reply other threads:[~2011-02-18 6:38 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-18 6:38 Kirk Hoganson [this message]
-- strict thread matches above, loose matches on Subject: below --
2011-02-22 21:28 Round Robin or Random Source NATing Kirk Hoganson
2011-02-22 23:50 ` John Lister
2011-02-23 18:43 ` Kirk Hoganson
2011-02-24 23:03 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D5E13F9.1050608@gmail.com \
--to=kirkhoganson@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox