Passing original IP information for source NAT translated traffic

DelvinC — Wed, 24 Jun 2020 00:25:13 GMT

I don't know the feasibility of this on the PAN. I've seen this done by means of custom scripts on load balancers. But, I thought it might be better to ask here since there are always more than one person with the same issue.

The current situation:

I have a PAN firewall between the Internet and my HA-Proxy server.
The source traffic arrives at the ingress of my PAN firewall from the Internet.
The traffic is forwarded to the destination HA proxy server by means of a destination translation NAT rule that also enforces a source NAT.
The source NAT translates the original source IP to the interface IP of the firewall.
Given the uniqueness of the environment, we can not get rid of the source NAT.
The HA-proxy server has a separate direct Internet access for outbound connectivity that doesn't go through the PAN firewall. However, the inbound connections from the Internet are source NAT'd through the PAN firewall.

My current requirement:

The HA-Proxy should be able to correlate or have knowledge about the original source IP address.

So, anyone out there who has run into a similar scenario before? Any hacks?
Lets brainstorm this out!

Thank you!

Re: Passing original IP information for source NAT translated traffic

kiwi — Thu, 25 Jun 2020 07:11:35 GMT

Hi @DelvinC ,

I can't think of a built-in feature that will do this for you.

First thing that came to mind was to use x-forward-for but that's a different scenario/setup than yours and can't be used for this I'm afraid.

Other users might have ideas or scripts.

Good luck !

-Kiwi.

topic Re: Passing original IP information for source NAT translated traffic in General Topics

Passing original IP information for source NAT translated traffic

Re: Passing original IP information for source NAT translated traffic