Forum Discussion
Dan_Williams_25
Nimbostratus
Sep 19, 2005Selective SNAT iRule
Apologize if this has already been posted.
I recently upgraded to a pair of 6400s that are running v.9.0.5. During the days of 4.5.x, I was able to utilize a "Selective SNAT" rule of sorts t...
Dan_Williams_25
Nimbostratus
Oct 22, 2005It's been a while, but I was finally able to catch up and try a few things out.
UnRuleY: The sample iRule you provided did work and solved the general problem, though for some reason, I had a problem adding additional source networks, so I ended up with the following:
snatpool snatpool.192.168.2.1 {
member 192.168.2.1
}
virtual forwarding_virtual {
destination any:any
ip forward
profile custom.fastL4.noreset
rule snat.rule
}
rule snat.rule {
when CLIENT_ACCEPTED {
if {([IP::addr [IP::remote_addr] equals "10.32.0.0/24"] and ([IP::addr "[IP::local_addr]" equals "192.168.1.0/24"] or [IP::addr "[IP::local_addr]" equals "172.31.1.0/24"] or [IP::addr "[IP::local_addr]" equals "10.0.1.0/24"]))} {
snat none
}
elseif {([IP::addr [IP::remote_addr] equals "10.64.0.0/24"] and ([IP::addr "[IP::local_addr]" equals "192.168.1.0/24"] or [IP::addr "[IP::local_addr]" equals "172.31.1.0/24"] or [IP::addr "[IP::local_addr]" equals "10.0.1.0/24"]))} {
snat none
}
else {
snatpool snatpool.192.168.2.1
}
}
}
In this instance, the source node networks are the 10.32.0/24 and 10.64.0/24 and the remote networks that we do not want to SNAT to are the 192.168.1/24, 172.31.1/24, and 10.0.1/24 networks--everything else is SNAT'd. The rule is applied to the forwarding_virtual--which is required for IP forwarding. The snatpool seems to be a much cleaner way to adding SNAT without applying a physical SNAT to a particular interface.
Thanks for the help.
-d
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects