Forum Discussion
NimbostratusVIP for SMTP to see the real client ip.
Hi all,
We have setup a VIP for port 25 and use the below irule together with data group to restrict the access. But we do not see the real client ip addresses I guess because of SNAT. Any suggestion to fix this?
/Jan
when CLIENT_ACCEPTED {
if { [class match [IP::client_addr] equals "SMTP_data_group"] }{ pool smtp_inbound } else { TCP::respond "550 message rejected - If you think this is an error report it to Global NOC" TCP::release TCP::close drop return } }
6 Replies
PeteWhiteEmployee
when CLIENT_ACCEPTED { if { [class match IP::addr [IP::client_addr] equals "SMTP_data_group"] }{ pool smtp_inbound } else { TCP::respond "550 message rejected - If you think this is an error report it to Global NOC" TCP::release TCP::close drop return } }
Jan_Rockstedt_4Hi Pete,
I am sorry for not explain the hole store. I want to see the client addresses on the destination servers internally, via F5.
//Jan
- PeteWhiteI see - if you want to SNAT then as you say you will lose the client IP address at the destination servers. You can use an iRule to decide whether to SNAT or not but the only way out of using SNAT is to make the f5 your default gateway or use some other routing.
- Jan_Rockstedt_4
The internal routing will be fixed be our internal routers and send to the F5, as the internal serves do not have the F5 as the default gateway.
But the SNAT is stripping off the client IP to the servers, as it should do. It would be nice to have a SMTP x-forward. :-) I was reading about this problem for other users and some sugestions was using NAT instead of SNAT. Any sugestion for a new irule or NAT? We need to see the client ip addresses on the servers for security resonds.
//Jan
Vitaliy_SavransNacreous
Hi Jan, after you fixed routes to F5, go to:
Local Traffic/Virtual Servers/Virtual_server_name/Properties/put "none" to Source Address Translation. You will see real client IP in logs of SMTP servers.
P.S. remember that in this case F5 must be default GW for smtp servers.
- pete_71470
Cirrostratus
You could also use nPath if the F5 doesn't need to be traversed for mail server responses (e.g., not modifying responses on the F5, etc). This is what we do here and it works like a charm.
