SNAT Confusion

[Janusz Krzysztofik]

Rodre Ghorashi-Zadeh napisał(a):
>> You are right, the problem is probably related to source address 
>> matching VIP configured on the director.
> 
> This is what I initially thought so what I did was SNAT the source 
> address (on the director) to be what I will refer to as a "token" IP 
> address, in this case 101.101.101.101, and set the default gateway on 
> the realserver to be the director, thinking that when the the realserver 
> replies it would not now how to route to 101.101.101.101 and send it 
> back to the director, which would have an entry in it's conntrack, and 
> SNAT it back to the original address, which is the realserver:

Yes, it sounds reasonable, but still does not solve the problem of 
director dropping packets with source address matching one of its own 
addresses.
> 
> realserver1 client (10.0.0.1:2777) -> director VIP (10.0.0.200:389) -> 
> DNAT 10.0.0.200:389 to 10.0.0.1:389 and SNAT 10.0.0.1:2777 to 
> 101.101.101.101:2777 -> send packet to realserver1 service 
> (10.0.0.1:389) -> director gateway IP 10.0.0.254 -> SNAT 10.0.0.1:389 to 
> 10.0.0.200:389 and DNAT 101.101.101.101:2777 to 10.0.0.1:2777 -> 
> realserver1 client (10.0.0.1:2777)
> 
To avoid confusion, I would describe this as below, using your "token" 
term for realserver1 SNATed IP, DMAC and RMAC1 meaning director and 
realserver1 MAC addresses:

1. realserver1 client: connect from RIP1:* to DMAC:VIP:389

2. director: LVS-NAT VIP:389 to RIP1:389 and netfilter SNAT RIP1:* to 
token:*, send to RMAC1:RIP1:389

3. relaserver1 service: answer from RIP1:389 to DMAC:token:* (DMAC 
resolved as MAC address of default gateway IP in your setup)

4. director: LVS-de-NAT RIP1:389 to VIP:389 and netfilter de-SNAT 
token:* to RIP1:8, send to RMAC1:RIP1:*
> 
> In theory this should work, no?
> 
In theory, yes, but I can not see any way to do it on LVS director, 
neither with Julian's conntrack patch (POSTROUTING nat not traversed, so 
netfilter SNAT not working), nor my patch (works only for LVS-DR method).

Assuming you keep using LVS-NAT method, you could try to set up 
netfilter SNAT of RIP1:*->VIP:389 to token:*->VIP:389 on the realserver 
itself and teach the director where to find "token" (solution 3 from my 
prevoius message). It sholud work without any IPVS patches.

Janusz