0

I wanted to implement load balancer (round robin) using 4 instances of ssh reverse tunnels running localhost:11669, localhost:11670, localhost:11671 & localhost:11672 connecting to remote host cmssyn.sys.com on 1669.

/usr/bin/ssh -L -N -a -q -4 -x -c blowfish -L 11669:127.0.0.1:1669 pssh@cmssyn.sys.com
/usr/bin/ssh -L -N -a -q -4 -x -c blowfish -L 11670:127.0.0.1:1669 pssh@cmssyn.sys.com
/usr/bin/ssh -L -N -a -q -4 -x -c blowfish -L 11671:127.0.0.1:1669 pssh@cmssyn.sys.com
/usr/bin/ssh -L -N -a -q -4 -x -c blowfish -L 11672:127.0.0.1:1669 pssh@cmssyn.sys.com

Although i have four SSH reverse tunnels, i am not getting the benefit of four tunnels as all the traffic is using only one ssh tunnel (11669).

I wanted to implement Round Robin routing using iptables, so that, First session should go to 11669 and the next session should go to 11670 and next to 11671 and next to 11672 and next to 11669 and so on.

I have created the following IP tables rules, however all the packets are getting redirected only to 11669 and not going to the other tunnels.

iptables -t nat -A OUTPUT -d 127.0.0.1 -m tcp -p tcp --dport 11669 -j REDIRECT --to-ports 11669-11672

Requesting your help to successfully route the traffic to all four ports on Round Robin mode.

Hello Aaron & Stoned,

Thanks a lot for your prompt reply, i have already tried adding --random, --RANDOM at the end and and i am getting the following error. 

[root@prod-unix-p4p06 ~]# iptables -t nat -A OUTPUT -d 127.0.0.1 -m tcp -p tcp --dport 11669 -j REDIRECT --to-ports 11669-11672 --random
iptables v1.3.5: Unknown arg `--random'
Try `iptables -h' or 'iptables --help' for more information.

# uname -r 
2.6.18-412.0.0.0.1.el5

# cat /etc/issue
Oracle Linux Server release 5.11
Kernel \r on an \m

I have even tried the same firewall rule on Oracle Linux 6.7 and 6.8.
Sven
  • 97,248
  • 13
  • 177
  • 225
Raj
  • 1
  • 1
  • What happens if you append `--random` to the end of your REDIRECT rule? – Aaron Feb 22 '17 at 19:31
  • I wonder about the usefulness of this, plus about the necessity of natting. Anyway the suggested random will work but it doesn't do any round robin balancing - it's pure and straight randomity, If you want proper load balancing you'll need to go through some more refined solution, such as haproxy or nginx (recent versions). – stoned Feb 22 '17 at 22:28

0 Answers0