__
___/ \_ \
_/ \__ +--------------+ \
/ \ +------------------------- | Connection 1 | \
| DMZ |----------| | eth0 +------+--------------+ \
\_ _/ | | L | \
\__ __/ | | I | +--------------+ \
\___/ |-----+ eth6 N eth1 +------| Connection 2 | \
| U R | +--------------+ \
| X O | +---INTERNET
__ | U | +--------------+ /
___/ \_ |-----+ eth5 T eth2 +------| Connection 3 | /
_/ \__ | | E | +--------------+ /
/ \ | | R | /
| Local network |----------| | eth4 +------+--------------+ /
\_ _/ +------------------------- | Connection 4 | /
\__ __/ +--------------+ /
\___/ /
Given that our network is described above.
The DMZ is made of web/mail/database servers that respond to requests from the outside via connections 1,2,3 & 4.
We have more than one webserver on the dmz. I want to map ips to the servers in the dmz as in
let say on connection one we have an ip 200.200.200.1
and if someone send a web-server request on that connection via that ip it will be dnat-ted to dmz server 192.168.0.1
For redudnancy I want requests coming in on another connection to go to the same webserver as well.
I have two webservers and I want them to be able to respond on all connections for redundancy. I though that this could be achieved by using ip-aliases on each interface whereby on connection 1, if someone requests port 80 via ip 200.200.200.1 it will go to 192.168.0.1 and if someone requests port 80 on 200.200.200.2, which is an aliased ip on conenction1/eth0, it should be dnat-ted to 192.168.0.2 which is another webserver.
The dnat part is easy and can be accomplished easily.
What i want to know about is the snat when the replies are being made.
Can this be done...
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j SNAT --to-source 200.200.200.1
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j SNAT --to-source 200.200.200.1
where i want to know if iptables will auto-magically take care of snat-ting the packets back the same ip it came in on even though both those ip's are on the same interface, ie, eth0
Will the first line take precedence? If something is going out on eth0 will it be snatted to 200.200.200.1 even though it came in via ip 200.200.200.2?
I have been reading on marking packets as well and have been advised to look into it. Is marking a needed option?
Please help