Postrouting not available in directors ?

Hello all. I'm new on this list and to the wonderful world of ultramonkey.
I have a question, searched in the archives but didn't find a clear 
answer (The last topic on the subject is from 2002, I think)
Hope this is not a FAQ.

I there a way to use the postrouting nat rule on a director ??

what I want to do is to dynamically change the source of the packet 
before it reaches the realserver.
I use a masquerading topology.

Long explanation (don't read this if you're not interested)

I have setup 2 directors ;
I have thoses services on the director : Webmail, Ldap, imap/pop ... All 
thoses services are served by 4 realservers:
4 for webmail, 4 for ldap, 4 for imap.

All my realservers have 2 network interface : 1 for the service of 
requests coming from ultramonkey, with an ip rule where default gw is 
LVS, 1 for administrative (ssh) and requests to other services provided 
on my intranet (default rule).

The problem is coming from the fact that my realservers, are, in 
reality, vservers (http://linux-vserver.org/), all hosted on 4 physical 
machines.

This configuration works very well, except when I re-enter in the 
ultramonkey.

Supose this case:

I have connection to Webmail, which in turn needs to ask an ldap server.

1) connection to webmail via ultramonkey, realserver Webmail-A is 
choosen. connexion go to eth0. (Webmail-A is a vserver on host A). reply 
go through the LVS. OK.
2) webmail-A need to ask the ldap. Request go from eth1, and reach the 
VIP of the director. OK
case 3a) director choose Ldap-B or C or D. Ldap request go from eth0 on 
vserver, and is answerd there, via LVS.  All is fine.
case 3b) no luck, director choose Ldap-A. Ldap-A is hosted on the same 
physical server. Ldap-A see packets from Webmail-A to Ldap-A. Ldap-A has 
a local route (rule 0, local table). He will reply DIRECTLY to 
Webmail-A, WITHOUT passing by director...

This is my problem.
No matter what ip rule I can make, I have NO WAY (well , not found the 
way) to route back the packet via the director. Ok, the fact that 
vservers share routing tables with host are directly due to the way 
linux-vserver works, and this is the source of my problem.
But I don't know how to resolve this...

After playing (without much succes) with local tables on host (where 
realservers lives),I thought the simplest way to achive was to modify 
the packet on the POSTROUTING side of the director (I need only when the 
SRC adress of the packet comes from the administrative interface of my 
realservers). but this don't seems to work

Quite a bit complicated, I guess...

Anybody have a slight idea ?

-- 
Yann Dupont, Cri de l'université de Nantes
Tel: 02.51.12.53.91 - Fax: 02.51.12.58.60 - [email protected]


-- 
Ultra Monkey - http://www.ultramonkey.org/
To UNSUBSCRIBE, email to [email protected], with a body:
unsubscribe ultramonkey-users [email protected]
where "[email protected]" is YOUR email address.