per machine SNAT
ramen at intnetsystems.com
Fri Jun 30 15:03:28 CEST 2006
I'm hoping someone might be able to point me in the right direction.
I have a large number of machines (potentially > 65,000) that I need to
be able SNAT to particular addresses for particular machines, onto a
Essentially I'm trying to achieve a dynamic DHCP -> fixed address
mapping onto a different network for logging and filtering based on ip
address. (The easiest way would be to do away with dynamic DHCP but I
unfortunately do not have that option. Also I will need to map
different networks onto the same network, which also negates the use of
static DHCP option.)
One way to do this is to write a custom rule for each machine, eg:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.100.50 anywhere to: 10.0.0.1
SNAT all -- 192.168.100.17 anywhere to: 10.0.0.2
SNAT all -- 172.16.45.18 anywhere to: 10.0.0.3
That's ok for a small number of machines, but performance obviously
drops off quickly for large numbers of rules.
I looked at using ipset, but this does seem to be able to be used in
this kind of case.
Also, unfortunately there is no algorithmic mapping in this case - the
information for the mappings will be stored in a database that will be
used to populate the rules.
Can anyone suggest a possible solution? I am willing to write my own
GPL'd kernel module (probably based on another that is part way there -
e.g. ipset) if that is the answer, but before I throw my effort into
that, I'm hoping that someone else might have an idea.
More information about the netfilter