Forum Discussion
LTM for load balance DNS queries with real IP addresses
Hello everyone,
I’m seeking advice from experts. I’ve configured an LTM to load balance requests across multiple internal DNS servers. However, I’m facing a challenge: the DNS servers need to see the real client IP addresses in the requests, rather than the LTM’s IP.
How can I achieve this? Please note that I only have an LTM license.
Thank you in advance for your assistance!
- zamroni777Nacreous
make dns server's routing config to clients goes thorugh f5, e.g using pbr in intermediate router, make f5 floating ip as default gw or etc.
hence you dont need to enable snat in f5 vserver config and dns servers can see clients ip addres.if you want f5 gtm/dns at low price, you can try the virtual edition.
dns traffic is low because clients only do 1 dns request for many application requests. - Aswin_mkCumulonimbus
Hi Aantat
There are several ways to get the actual ip in backend. but in your case as its a udp/tcp traffic we have do like below
To ensure that the DNS servers see the real client IP addresses instead of the LTM’s IP address, you can use SNAT (Source Network Address Translation) selectively or disable it depending on your requirements. Here are the potential approaches and their configurations:
By default, the LTM may translate the source IP address of incoming requests to its self-IP if SNAT is enabled. You can disable SNAT to preserve the original client IP.Steps:
Go to the virtual server configuration in the BIG-IP GUI.
Under Configuration, set SNAT Pool to None.
Ensure the DNS servers' default gateway is set to the LTM's self-IP in the same VLAN or subnet.Considerations:
This method requires the DNS servers to route responses back through the LTM. If the DNS servers use a different default gateway, the connection will break(Please note this).2. LTM to load balance requests across multiple internal DNS servers. - for this you only need LTM license. If you need to load balancer servers in different DC and if you need configure a fqdn in F5- u need a GTM license (You can license in same or different VM).
BR
Aswin
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com