|
On Tuesday 16 September 2008 00:24:38 Joseph Mack NA3T wrote:
> On Mon, 15 Sep 2008, Simon Horman wrote:
>
> > Well, it would be a problem if it gets DNATed a second time.
>
> Are you just being really safe? Are you trying to prevent
> someone from adding DNAT rules to OUTPUT?
>
> Would it be better (as much as possible) for LVS to appear
> to be just another netfilter module, in which case if
> someone wants to DNAT in OUTPUT, this should be allowed
> (whether it's sensible or not). Currently LVS-NAT doesn't
> allow SNAT on OUTPUT, which no-one thought about when
> LVS-NAT was first written and it turns out to be useful.
For what it's worth, I'm currently using DNAT alongside LVS-NAT
for certain connections. It only serves a secondary purpose and
there are other ways (although not as simple) to achieve the
purpose, but it has proven useful.
--
Jason Stubbs <j.stubbs@xxxxxxxxxxxxxxx>
LINKTHINK INC.
東京都渋谷区桜ヶ丘町22-14 N.E.S S棟 3F
TEL 03-5728-4772 FAX 03-5728-4773
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
