1

We have following setup :

  1. client (10.10.0.2)
  2. balancer (eth1: 10.11.0.3, eth2: 10.12.0.1)
  3. web-server (eth1: 10.11.0.4, eth2:10.12.0.2 and eth1:10.11.0.3 see below how)
  4. Masquerading router to route 10.10 to 10.11.

each is running ubuntu 18

TCP connection is going from client via balancer to web-server.

When SYN packet comes to balancer (10.11.0.3), I do DNAT to ip of web-server ( 10.12.0.2) and it routes perfectly, appearing at web-server.

At web-server, I do DNAT for that packet to 10.11.0.3 (same ip as balancer, but attached to web-server).

To make web-server recognize 10.11.0.3 as local and not conflict with balancer's 10.11.0.3, I filter ARP requests (who-has 10.11.0.3) at web-server. Finally, I want to make reply packets to go directly to client, from eth1 10.11.0.3. However, packets are out from eth2, to which they came becase connection is established and everything is cached.

If I run following setup :

client->balancer->intermediary->web-server, I can do all the packet mangling at intermediary and it works flawlessly. If web-server is on the same machine where mangling performed, I can't mangle reply packets.

Any idea how to overcome this?

  • How are the interfaces connected between client, balancer and web-server? Which network masks do you use? Can you explain why you need to do this unusual mangling? Maybe there is a different way to solve your problem. Please edit your question to add clarification. – Bodo Feb 14 at 9:42
  • Thanks for your comment. Everywhere is used /24 mask. Such unusual mangling is needed for load balancing. When I do DNAT on balancer without such spoofing at app-server, traffic returns through balancer in this case, no matter how many app-servers I have behind balancer, my outgoing throughttput is limited to balancer interface bandwidth. For example : if I have 1 balancer with 2 1Gig ports, and 10 app-servers with 2 1Gig port each, I can produce only 1 Gig of outgoing traffic, despite app-servers can produce 10 Gig of trafic. – Александр КМ Feb 14 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.