Re: Any plans implementing FNAT ("Full NAT") in keepalived?

Ok i think i know what you are getting at.
packet comes in on eth0 then you do an SNAT then hit the LVS and do
DNAT or any other mode you want.
I would recommend involving a dummy interface (dummy0, dummy1 or on
newer versions of fedora d1, d2)  this is different then a "loopback"
interface (lo) on Linux but similar to a "loopback" interface on BSD
Unix and Network switches.
The difference being that any address on a  lo interface on Linux
becomes a martian but not on a dummy interface, by the way this is the
biggest mistake in Quagga's documentation while its correct on BSD its
wrong on Linux and forces you to do a lot of nasty thing to work
around using the loopback.
So what I would recommend is binding the LVS instance to an IP on a
dummy interface that way the SNAT happens before hitting the LVS
interface. the big reason to do it that way is it will be much easier
to debug if something goes wrong.
Linux dummy interfaces are fun for doing cool things on a firewall
I've even used them with openvswitch instances to allow Linux
Firewalls to participate in SPB (Shortest Path Bridging) but that's a
story for an other list :).

On Wed, Jan 4, 2017 at 2:58 AM, Bernd <[email protected]> wrote:
> Am 2017-01-04 01:33, schrieb [email protected]:
>
>> What do you mean by "Full NAT‎"? It sounds like gibberish to me :),
>> and I want to understand what you are asking about.
>> If you are talking about (that edge case mode which involves Quagga)
>> what I think you are yes patches were added to keepalived and LVS,
>> however the linux kernel IPVS patches were hard ‎to a specific (very
>> old now)kernel version of the and the code as far as I know was never
>> accepted into the Linux kernel main source.
>> Rather than waiting for the Linux kernel update which will probably
>> never happen you are better off letting us know what you would like to
>> do and‎ we can see if we can help you. Things tend to go a little
>> sideways when you involve Quagga because of its poor outdated
>> documentation so this is deffinity an area where I would expect more
>> questions then I've seen.
>
>
> I need to build a similar setup as mentioned in the links I provided.
>
> Yes, I saw the patches were for Kernel 2.6.32, which is (still) being used
> in RHEL/CentOS 6. I did my research and did not find them included in recent
> Kernels, so yes, it seems they never made it into Vanilla.
>
> Quagga is involved (I run OSPF), but it won't "harm" my setup. However, I
> still need the SNAT stuff – I will build that by marking packets then and
> create appropriate rules with iptables, hoping that this will be sufficient.
>
> Best,
>
> Bernd
>
>
>>   Original Message
>> From: Bernd
>> Sent: Tuesday, January 3, 2017 07:19
>> To: [email protected]
>> Subject: [Keepalived-devel] Any plans implementing FNAT ("Full NAT")
>> in keepalived?
>>
>> Hi,
>>
>> I came across FNAT again last year, however, this time I'm forced to
>> implement it.
>>
>> There are several pages mentioning it (e.g., [1], [2], [3]), and there's
>> a wiki page [4] mentioning that keepalived had an ``lb_kind FNAT'' as an
>> option.
>>
>> However, I do not see that anywhere in the latest release's source code,
>> nor is it mentioned in the documentation.
>>
>> Is there any plans to implement it?
>>
>> Best,
>>
>> Bernd
>>
>> --
>>
>> [1] –
>>
>> https://www.loadbalancer.org/de/blog/enabling-snat-in-lvs-xt_ipvs-and-iptables
>>
>> [2] – https://lwn.net/Articles/354771/
>>
>> [3] – https://lwn.net/Articles/394906/
>>
>> [4] – http://kb.linuxvirtualserver.org/wiki/IPVS_FULLNAT_and_SYNPROXY

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel