Forum Discussion

Aantat's avatar
Aantat
Icon for Cirrus rankCirrus
Dec 12, 2024

LTM for load balance DNS queries with real IP addresses

Hello everyone,

I’m seeking advice from experts. I’ve configured an LTM to load balance requests across multiple internal DNS servers. However, I’m facing a challenge: the DNS servers need to see the real client IP addresses in the requests, rather than the LTM’s IP.

How can I achieve this? Please note that I only have an LTM license.

Thank you in advance for your assistance!

  • make dns server's routing config to clients goes thorugh f5, e.g using pbr in intermediate router, make f5 floating ip as default gw or etc.
    hence you dont need to enable snat in f5 vserver config and dns servers can see clients ip addres.

    if you want f5 gtm/dns at low price, you can try the virtual edition.
    dns traffic is low because clients only do 1 dns request for many application requests.

  • Hi Aantat 

     

    There are several ways to get the actual ip in backend. but in your case as its a udp/tcp traffic we have do like below

     

    To ensure that the DNS servers see the real client IP addresses instead of the LTM’s IP address, you can use SNAT (Source Network Address Translation) selectively or disable it depending on your requirements. Here are the potential approaches and their configurations:


    By default, the LTM may translate the source IP address of incoming requests to its self-IP if SNAT is enabled. You can disable SNAT to preserve the original client IP.

    Steps:
    Go to the virtual server configuration in the BIG-IP GUI.
    Under Configuration, set SNAT Pool to None.
    Ensure the DNS servers' default gateway is set to the LTM's self-IP in the same VLAN or subnet.

    Considerations:
    This method requires the DNS servers to route responses back through the LTM. If the DNS servers use a different default gateway, the connection will break(Please note this).

     

    2. LTM to load balance requests across multiple internal DNS servers. -  for this you only need LTM license. If you need to load balancer servers in different DC and if you need configure a fqdn in F5- u need a GTM license (You can license in same or different VM).

     

    BR
    Aswin