specific source port translation

Hi Nitass,

 

Just now I saw your comment, so thanks again for your effort to reply 🙂

 

I didn't exactly understood how you can determine which TMM will handle the traffic when the traffic return to the F5 and not leaving it..

 

 

Let me explain you what I need to achieve.

 

We have a demand to do the following:

 

do kind of a static SNAT from private IP to Public IP and source port from a range of ports. for example:

 

192.168.0.1 --> 203.0.113.1:1024-5055

 

192.168.0.2 --> 203.0.113.1:5056-9087

 

192.168.0.3 --> 203.0.113.1:9087-13119

 

192.168.0.4 --> 203.0.113.1:13120-17151

 

192.168.0.5 --> 203.0.113.1:17152-21183

 

 

of course there are more than one public IP..

 

and so on..

 

This idea come in order to be able to know who was the private IP based on the public IP and port without the need of logging.

 

 

Now I wrote a irule that do that, you can review it and comment if you have better ideas:

 

[root@LBA-F5-1A:Active] config  b rule SNAT list
rule SNAT {
   when RULE_INIT {
        log local0.alert "Building new SNAT configuration"
        Build the SNAT IPs ----------------------------------------------------------
         Configure the name of the SNAT pool here
        set static::snatpool_name "SNAT_Pool"
         Hide the members command from the iRule parser (BZ381099 comment 7)
        set static::members_cmd "members -list $static::snatpool_name"

         Clear any pre-existing array of the same name
        unset -nocomplain static::snat_ips
        unset -nocomplain static::SNAT

        Define the port block size
        set static::BlockSize 1000


        Define the amount of private IPs for one Public IP
        set static::AmountPrivateInPublic 3


        define the start port
        set static::StartPort 2000


         Loop through the SNAT pool members and add them to an array for faster access
         If the SNAT pool is modified, the RULE_INIT code needs to be re-run to re-read the SNAT pool
         Make a simple change like adding a space to a comment to force a re-run of RULE_INIT.
        foreach static::snat_ip [eval $static::members_cmd] {
                set static::IP [lindex $static::snat_ip 0]
                for {set j 0} {$j < $static::AmountPrivateInPublic} {incr j} {
                        for {set i 0} {$i < $static::BlockSize} {incr i} {
                                lappend static::SNAT(${static::IP},$j) [expr {$i + $static::StartPort + ($static::BlockSize*($j))}]
                        }
                }
        }
         Clear the variables we will not use anymore
        unset static::snatpool_name static::members_cmd static::snat_ip i j 
         ----------------------------------------------------------------------------------------
}

when CLIENT_ACCEPTED {

        log local0.alert "Private IP --> [IP::client_addr]:[TCP::client_port] -- "
        set PublicIP "[class search -value PrivateToPublic eq [IP::client_addr]]"
        set PortBlock "[class search -index PrivateToPublic eq [IP::client_addr]]"
        set PortBlock [expr {$PortBlock % $static::AmountPrivateInPublic}]

        Check if the Private IP exist in the class
        if { $PublicIP eq "" }{
                snatpool SNAT_Default
                return
        }

        set static::PortNum [lindex $static::SNAT($PublicIP,$PortBlock) 0]

        log local0.alert "Private IP --> [IP::client_addr]:[TCP::client_port] Public IP --> $PublicIP:$static::PortNum"
        Do SNAT with the selected public IP & port
        snat $PublicIP $static::PortNum
        Remove the port from the List of ports
        set static::SNAT($PublicIP,$PortBlock) [lreplace $static::SNAT($PublicIP,$PortBlock) 0 0]

}

when SERVER_CLOSED {
        Check if the SNATed IP exist in the class
        if { [class match [IP::local_addr] eq SNAT_Default] }{
                return
        }

        Finding the port block number
        set BlockNum [expr {(([TCP::local_port] - $static::StartPort) / $static::BlockSize)} ]
        log local0.alert "Closing Connection --> [IP::local_addr]:[TCP::local_port] Block --> $BlockNum "
        Adding the port back to the pool of available ports
        lappend static::SNAT([IP::local_addr],$BlockNum) [TCP::local_port]
}
}

[root@LBA-F5-1A:Active] config  b class PrivateToPublic list
class PrivateToPublic {
   {
      "192.168.0.1" { "203.0.113.1" }
      "192.168.0.2" { "203.0.113.1" }
      "192.168.0.3" { "203.0.113.1" }
      "192.168.0.4" { "203.0.113.1" }
      "192.168.0.5" { "203.0.113.1" }
   }
}

[root@LBA-F5-1A:Active] config  b class SNAT_Default list
class SNAT_Default {
   "203.0.113.2"
}