SNAT Confusion

[Janusz Krzysztofik]

Rodre Ghorashi-Zadeh napisał(a):
> I am using LVS-DR and not LVS-NAT.

So what did you mean saying:
 >>> realserver1 client (10.0.0.1:2777) -> director VIP (10.0.0.200:389)
 >>> -> DNAT 10.0.0.200:389 to 10.0.0.1:389 ...
I assumed this "DNAT" is LVS-NAT. If it is netfilter DNAT, it happens in 
nat PREROUTING hook, so how would your packets be processed by LVS INPUT 
hook, that expects VIP as destination address? Please give more details 
on your setup if there are any not mentiond yet, or think it over again.

  I tried this with your SNAT patch in
> place but it wasn't working, even though I could see the packets being 
> SNAT-ed to the "token" ip address, both in the iptables counters and 
> with tcpdump.
> 
Could you see replys as well? If you see them on the director comming 
and not leaving it, we have already suggested they could be dropped 
because their source addresses (VIP) match one of the director own 
addresses. Could you please confirm or deny if this is still true in 
your setup?

> Also, I tried SNAT-ing the initial request from the realserver to a 
> "token" ip address and used routing on the director in LVS-DR mode to 
> send the replies back to the client/realserver (your recommendation #3) 
> but this didn't work for me either.

Please be more specific. Trace your packets and describre what can you 
see and where do they disappear.

  Could you explain this setup a
> little better?


Using unmodified LVS-NAT:

1. realserver1 client: connect from RIP1:* to DMAC:VIP:389, SNAT RIP1:* 
to token:* before sending

2. director: LVS-NAT VIP:389 to RIP1:389, send to RMAC1:RIP1:389

3. relaserver1 service: accept, answer from RIP1:389 to DMAC:token:*

4. director: LVS-de-NAT RIP1:389 to VIP:389, send to RMAC1:token:*

5. realserver1 client: de-SNAT token:* to RIP1:*, accept.


Using unmodified LVS-DR:

1. realserver1 client: connect from RIP1:* to DMAC:VIP:389, but SNAT 
RIP1:* to token:* before sending (requirement: no VIP on the realserver)

2. director: LVS-DR send to RMAC1:VIP:389

3. relaserver1 service: DNAT VIP:389 to RIP1:389, accept, answer from 
RIP1:389 to DMAC:token:*, de-DNAT RIP1:389 to VIP:389 before sending

4. director (or another router): route to RMAC1:token:*

5. realserver1 client: de-SNAT token:* to RIP1:*, accept.


Janusz