2.0.RC3 NET BALANCER – 1:1 Nat Virtual Servers not managable

Hi there,

yesterday I upgraded my Soekris 5501 to a Gigabit capable Soekris 6501. My old system was runnung on ZS Release 1.0 Beta14.
I decided to upgrade to Release 2.0.RC3. I am using Zeroshell for many years in different situations. Its a very
good project, keep on moving!

My Setup:
WAN Link 1 ETH00: CABLE 100Mbps with dynamic public ip adress
WAN Link 2 ETH01: ADSL 5Mbps with static /28 (16 adresses) public ip range
internal ETH02: users (me) 192.168.10.130
internal ETH02: server 192.168.10.209

My Goal:(which was working on 1.0 Beta14):
I want to map my internal server with a 1:1 Nat to on of my static public ip addresses.

My Configuration:
I made a 1:1 Nat under Setup -> Startup/Cron -> NAT and Virtual Servers script

iptables -t nat -I PREROUTING 1 -d 132.15.128.4 -i ETH01 -j DNAT –to-destination 192.168.10.209
iptables -t nat -I POSTROUTING 1 -s 192.168.10.209 -o ETH01 -j SNAT –to-source 132.15.128.4

—

Then I added the required rule to the Firewall

—

A and at last I setup the Net Balancer and Balancing Rules:

Failover Mode

Gateway Description | IP Address    | Interface | Weight |  Timeout Coefficient

ADSL                | 132.15.128.1  |           |    1   |  x8

CABLE               | 212.116.202.1 |           |   99   |  x1

I want all outgoing connections to use my fast link so i set the weight of the CABLE to 99

Balancing Rules to route all traffic from the server to the ADSL Gateway:
MARK all opt — in * out * 192.168.10.209 -> 0.0.0.0/0 MARK set 0x65 ADSL (132.15.128.1)

—

So far so good! and this setup worked perfectly on 1.0 Beta14. On the latest 2.0.RC3 i can see the following effect:

when I connect from the Internet to the defined external public address of my server 132.15.128.4 i check the firewall interface ETH01 with tcpdump
I see packages comming in. On the server 192.168.10.209 i can see the the packages arriving and leaving towards the firewall again but at the
firewall the packages dont leave through the per Balancing Rule defined Gateway, they leave though the Interface that has the highest weight.
In my case its CABLE ETH00 (99).

When I iniciate a connection to the Internet from the shell prompt of the server 192.168.10.209 i get routed correctly through the Balancing Rules defined gateway.

Conclusion:
For me it looks like NET BALANCER’s Balancing Rules are ignoring iptables POSTROUTING rules. In such a case the balancer just goes for the weight of the connection instead of looking at the balancing rules first. Maybe some priority changed from Beta14 to 2.0.RC3, the balancer should look at the rules first and if not found go for the weight.

Do you have similar experience?

i saw similar threads:
Internal service behind load balancer – ZeroShell 2.0 RC1 -> https://www.zeroshell.org/forum/viewtopic.php?t=3794

Bug in Loadbalacing or Virtual Server in 2.0.RC1 -> https://www.zeroshell.org/forum/viewtopic.php?t=3704

Greets Mike