Forum Discussion

Jure_Simsic_106's avatar
Jure_Simsic_106
Icon for Nimbostratus rankNimbostratus
Jan 08, 2007

NAT-like Virtual Server

I have a problem I need to solve. We have our DMZ (net A) with some

 

nodes and a BigIP, with a private net (net B) behind, with load

 

balanced servers there - standard configuration.

 

Now I have a need to do load balancing (actually just fail-over) on

 

some systems in A that couldn't be moved to B. These systems have

 

their default gateway set to the firewall and that can't be

 

changed. What I'd need would be an IP on the LB, that would make

 

requests to nodeA1 or nodeA2 with source IP of the LB, so the boxes

 

would be able to route the traffic correctly - that is, back to LB and

 

from here on back to the client.

 

As in:

 

 

Client -> LB-VIP-A -> nodeA(1|2) -> LB-VIP-A -> Client

 

[request] [response]

 

 

This is needed for internal requests from clients within net A, so

 

unless I can rewrite SRC, the response (syn ack) would go directly to

 

client and the handshake would never be completed (as in client is

 

sending to some virtual IP on LB and getting a response back from

 

another IP)..

 

 

A basic version of this could be done as NAT, but i'd like to have a

 

monitor on for services for fail over and use just one server node at a time, not round-robin. Should I do a standard Virtual

 

Server and rewrite the srcIP with irules or is there another way to

 

handle such requests?

 

So in case of Irules, how would I manage to rewrite the response back to original client IP (dst IP), that information would get lost i guess..

3 Replies

No RepliesBe the first to reply