UDP and address spoofing

Hi all,

I’m trying to create some NAT rules using Haproxy (replacing nginx) and I’m struggling with one situation.

When I do TCP rules, everything is working properly and I have rules like the following:

listen ldap
    bind 10.0.192.36:636
    source 172.18.81.55
    server ldap_1 172.18.0.10:636
    server ldap_2 172.18.0.11:636

Here, I set the source.ip to another one, that is the one allowed in the firewall.

However, I need to create also a nat rule for dns requests and this is working with UDP.
I can create a rule like the following:

log-forward dns
   dgram-bind 10.0.192.35:53
   log 172.18.16.11:53 local0
   log 172.18.16.12:53 local0

But it is a requirement in my network that the NAT requests are sent with source.ip one of the virtual ips I’ve created with keepalived. In this case is “172.18.81.55” as you can see in the tcp rule.

Is this possible with UDP?

Thanks
Regards.
Luis

1 post - 1 participant

Read full topic