Re: Round Robin or Random Source NATing

[John Lister <john.lister@kickstone.com>]

On 22/02/2011 21:28, Kirk Hoganson wrote:
> I am attempting to create a series of rules that source nat web 
> traffic amongst a pool of IP addresses.  I have used the nth mode to 
> cycle through the IP address in a round robin fashion.  I am using the 
> following rules:
>
> $IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m 
> multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 0 
> -j SNAT --to-source 1.104.126.216
Beware that the statistic module counts apply PER rule and not to some 
global counter as they used to in earlier versions - this caught me out 
before. So with your case, the first rule is matched every 24 packets, 
but the second one is matched every 24 packets NOT matched by the 
earlier rule, and so on. So any default in your case is much more likely 
to happen than you expect.
try doing something like:
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m 
multiport --dport 80,443 -m statistic --mode nth --every 24 --packet 0 
-j SNAT --to-source 1.104.126.x
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m 
multiport --dport 80,443 -m statistic --mode nth --every 23 --packet 0 
-j SNAT --to-source 1.104.126.x
$IPTABLES -t nat -A POSTROUTING -o $EXT -m state --state NEW -p tcp -m 
multiport --dport 80,443 -m statistic --mode nth --every 22 --packet 0 
-j SNAT --to-source 1.104.126.x


The same applies with random, you need to reduce the probability based 
on the chance of it being hit, eg:
.25, .33, .50, 1