Forum Discussion
schmal_111133
Nimbostratus
Feb 13, 2013specific source port translation
Hi,
I am trying to do SNAT while selecting a specific port for that but for some reason when the F5 receive the response it is sending a RST to the WS and not retranslating it to the original IP...
nitass
Employee
Feb 15, 2013if you want to use specific snat port, for example, 12345, it might be possible to forward client-side traffic to specific tmm which will handle port 12345 on server-side.not sure if this is a good idea. anyway, i did a little bit test as following.
bar is virtual server which receives client traffic. then if tmm for port 12345 is the one which traffic is coming, apply snat and send it out normally. otherwise, send traffic to specific tmm throught tmm_vs.
[root@B3900-R72-S18:Active] config b virtual bar list
virtual bar {
translate address enable
destination any:any
mask 0.0.0.0
rules bar_rule
}
[root@B3900-R72-S18:Active] config b rule bar_rule list
rule bar_rule {
when RULE_INIT {
set static::tmm_num [TMM::cmp_count]
set static::srcip "200.200.200.18"
set static::srcport 12345
}
when CLIENT_ACCEPTED {
set tmm_in [TMM::cmp_unit]
set tmm_out [expr {($static::srcport ^ [TCP::local_port]) % $static::tmm_num}]
log local0. "incoming | client [IP::client_addr]:[TCP::client_port] server [IP::local_addr]:[TCP::local_port] tmm $tmm_in"
if {$tmm_in == $tmm_out} {
set ps_local 1
snat $static::srcip $static::srcport
node [IP::local_addr]
} else {
set ps_local 0
node 127.10.1.[expr {$tmm_out + 1}]
}
}
when SERVER_CONNECTED {
if {$ps_local} {
log local0. "outgoing | client [IP::local_addr]:[TCP::local_port] server [IP::remote_addr]:[TCP::remote_port] tmm [TMM::cmp_count]"
} else {
table set "[IP::local_addr]:[TCP::local_port]" [clientside {IP::local_addr}]
}
}
}
[root@B3900-R72-S18:Active] config b virtual tmm_vs list
virtual tmm_vs {
translate address enable
destination 126.0.0.0:any
mask 254.0.0.0
rules tmm_rule
}
[root@B3900-R72-S18:Active] config b rule tmm_rule list
rule tmm_rule {
when CLIENT_ACCEPTED {
snat $static::srcip $static::srcport
node [table lookup "[IP::client_addr]:[TCP::client_port]"]
}
when SERVER_CONNECTED {
log local0. "otugoing | client [IP::local_addr]:[TCP::local_port] server [IP::remote_addr]:[TCP::remote_port] tmm [TMM::cmp_unit]"
}
}
test
[root@B3900-R72-S18:Active] config tail -f /var/log/ltm
Feb 15 22:58:15 local/tmm3 info tmm3[5371]: Rule bar_rule : incoming | client 100.100.100.1:43677 server 172.28.19.251:22 tmm 3
Feb 15 22:58:15 local/tmm3 info tmm3[5371]: Rule bar_rule : outgoing | client 200.200.200.18:12345 server 172.28.19.251:22 tmm 4
Feb 15 22:58:24 local/tmm1 info tmm1[5369]: Rule bar_rule : incoming | client 100.100.100.1:38558 server 172.28.19.251:23 tmm 1
Feb 15 22:58:24 local/tmm2 info tmm2[5370]: Rule tmm_rule : otugoing | client 200.200.200.18:12345 server 172.28.19.251:23 tmm 2
Feb 15 22:58:30 local/tmm3 info tmm3[5371]: Rule bar_rule : incoming | client 100.100.100.1:55203 server 172.28.19.251:80 tmm 3
Feb 15 22:58:30 local/tmm1 info tmm1[5369]: Rule tmm_rule : otugoing | client 200.200.200.18:12345 server 172.28.19.251:80 tmm 1
Feb 15 22:58:34 local/tmm info tmm[5368]: Rule bar_rule : incoming | client 100.100.100.1:39711 server 172.28.19.251:443 tmm 0
Feb 15 22:58:34 local/tmm2 info tmm2[5370]: Rule tmm_rule : otugoing | client 200.200.200.18:12345 server 172.28.19.251:443 tmm 2
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects