SNAT for Specific Subnet

Forums Technical Forums
,
1

Hi ,

we have 5 VIP we have enable Snat on pool member. can we enable SNAT in this way if traffic coming from 10.0.0.0/8 subnet. Snat should work otherwise not. is there any way with Irule or another way to do that.

Thanks

A.N

2

This should help

when CLIENT_ACCEPTED {

if { [IP::addr [IP::remote_addr] equals 10.0.0.0/8] } {

snat automap

} else {

return

}

}

3

An SNAT is specified at the Virtual Server level, not the Pool or Member level. An iRule would be your best bet, something like this;

when CLIENT_ACCEPTED {
 if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Alternatively, specify a SNAT Pool instead
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}
4

Sorry Ajmaluddin, didn’t spot your post till I’d saved mine.

5

Hi,

But we have only option to enable SNAT on pool level not on VIP level. let me correct if i am wrong

Thanks

A.N

6

You can only SNAT at the VIP level. However, if you specify a pool within an iRule you can SNAT differently per pool. Please clarify your requirements.

7

yes. i am looking for VIP level.

Thanks for your help

just last question . can we add two subnet as source in same IRULE . Like 10.0.0.0/8 and 192.168.2.0/24

Thanks & Regards

A.N

8

Great. You could add a second like this, there a few other ways you could do it too;

when CLIENT_ACCEPTED {
 if { (([IP::addr [IP::client_addr] equals 10.0.0.0/8]) or ([IP::addr [IP::client_addr] equals 192.168.2.0/24 ])) } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Alternatively, specify a SNAT Pool instead
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}
9

This is a longer method but allows for different actions based on the source subnet;

when CLIENT_ACCEPTED {
 if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } {
  Use SNAT Automap if client IP is in this range
  snat automap
  Stop processing the iRule for this event
  return
  }
 elseif { [IP::addr [IP::client_addr] equals 192.168.2.0/24] } {
  snatpool name
  Stop processing the iRule for this event
  return
  }
 else {
  Stop processing the iRule for this event if no match
  return
  }
}