SNAT every packet in a connection

SNAT every packet in a connection

[Ashok Rao]

I have 2 WAN connections on my Linux router and I'd like to do
load-balancing  of packets relating to the same connection.
There are lots of examples out on the net for setting up routes and
rules to send packets
to both links - and I have got those working - however I want to NAT
the source IP address of the outgoing packets based on the packet MARK
so that  I can make each packet  go out with the IP address of the
outgoing interface.

From whatever I've read and seen myself, the NAT table is only
traversed for the first packet of a connection.
Hence packets in a  single connection will always be SNATed to the
same IP  - Hence the packets going out on one of the interfaces will
not have the right source IP.

I'm starting to take a look at ip_nat_core.c ip_nat_standalone.c   -
would it make sense to try to modify those to achieve what I want ?
So far I've been using dumb NAT to achieve this  - but it is very
primitive.

Thanks in advance.

Re: SNAT every packet in a connection

[Benny Amorsen]

"Ashok Rao" <greatarbor@gmail.com> writes:

> From whatever I've read and seen myself, the NAT table is only
> traversed for the first packet of a connection. Hence packets in a
> single connection will always be SNATed to the same IP - Hence the
> packets going out on one of the interfaces will not have the right
> source IP.

The receiving end of the connection will be rather confused when it
gets 10 packets from 1.1.1.1 followed by 10 packets from 2.2.2.2 in
the same connection. Or rather, it should just drop the ones from
2.2.2.2.

What you want is basically impossible.


/Benny

Re: SNAT every packet in a connection

[Ashok Rao]

I should have explained in my original posting that this is for Point
to Point application. I have a
server at the other end  (receiving end of the connection) which will
receive these packets, make the source IP the same and
deliver to the LAN.
And as I said - I am already doing this today - albeit with many caveats such as
a) Point to Point load-balancing only (remote to central site)
b) Currently handle only one host in remote site





"Ashok Rao" <greatarbor@gmail.com> writes:

> From whatever I've read and seen myself, the NAT table is only
> traversed for the first packet of a connection. Hence packets in a
> single connection will always be SNATed to the same IP - Hence the
> packets going out on one of the interfaces will not have the right
> source IP.

The receiving end of the connection will be rather confused when it
gets 10 packets from 1.1.1.1 followed by 10 packets from 2.2.2.2 in
the same connection. Or rather, it should just drop the ones from
2.2.2.2.

What you want is basically impossible.


/Benny