FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

What is SNAT, and why is it used by default? ​

Short answer

SNAT (Source NAT) is TR7's use of its own IP, not the client's, as the source address in the connection it opens to the Backend Service. In the SNAT field of the Backend Service, the default value is Default: the source address is the Interface IP of the interface the traffic to the server leaves from in the Backend Service's Route Table, in the same subnet as the server (or as the gateway, if the server is reached through a gateway). It is the default because the server sends the response to the source address, that is, to TR7; the return path is correct on its own, and no change is required in the network or on the servers. The cost is that the server sees TR7's IP, not the client's.

How Does It Work? ​

  1. The client connects to TR7; in HTTP and L7 TCP vServices, TR7 terminates this connection.
  2. TR7 opens a new connection to the Backend Service. With Default, the source address is the Interface IP of the interface the traffic to the server leaves from in the Backend Service's Route table, in the same subnet as the server (if the server is reached through a gateway, the Interface IP in the same subnet as the gateway). In a cluster, each device uses its own Interface IP. If more than one IP has been added to the interface in that subnet, which one will be used cannot be determined from the order on the interface; if a specific address is required, Use Device IP is selected.
  3. The server sends the response to TR7; TR7 forwards the response to the client.

Example: TR7, whose Interface IP in the Route table is 192.0.2.5/24, connects to the server at 192.0.2.20 with the source 192.0.2.5; if the server at 203.0.113.20 is reached through the 192.0.2.254 gateway, 192.0.2.5 is used again.

Why the default? The server always sends the response to the source address of the request. When the source is TR7, the response returns to TR7 regardless of the server's default gateway, and the flow remains symmetric. If the source were the client's IP, the server would send the response to its own gateway, the response would bypass TR7 and the connection could not be established (Why do my backend servers see all requests as coming from TR7's IP?).

SNAT Options ​

OptionSource seen by the serverRequirement
DefaultThe Interface IP of the interface the traffic to the server leaves from in the Route table, in the same subnet as the server (or as the gateway, if the server is reached through a gateway)None
Use Device IPThe selected TR7 IP (the SNAT IP list is limited to the IPs in the Backend Service's Route table; the first address is selected automatically)The IP must be defined in the Route table
Use Client IPThe client's IP (SNAT is not performed)Responses must return from TR7: the default gateway of the servers is TR7, or Spoofing is on

The fields are in the Details section of the Backend Service form; in a Backend Group, they are set at the group level and applied to all the servers in the group.

In TR7 ​

  • Client IP: While SNAT is on, the client IP is carried not in the connection but in other ways: the X-Forwarded-For header in HTTP, and the PROXY protocol if the server supports it (How do I see the real client IP on the backend?).
  • Network vService: SNAT is not a Backend Service field but an LB Mode option, and the source address is selected in the SNAT IP field of the vService; in a new Network vService, the default mode is Direct Server Return. The SNAT field of the Backend Service is not used in a Network vService.
  • View: The SNAT row in the Details tab of the Backend Service preview shows the selection; if it is not defined, Default is written (Details rows).
  • Cluster: The change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Common Misconceptions ​

  • "SNAT is also applied to health checks." The source of the health check is determined by a separate field, Health Check Source IP (Which source IP are health check packets sent from; can I change it?).
  • "When Use Client IP is selected, the client IP appears on its own." It must also be ensured that the responses return from TR7; otherwise, connections cannot be established.
  • "With Default, the IP of the first interface in the route table is used." The source is not the first interface IP in the route table; it is the Interface IP of the interface the traffic to the server leaves from, in the same subnet as the server (or as the gateway, if the server is reached through a gateway).
  • "If the address in Use Device IP is deleted, an error occurs." If the selected IP is removed, the source address is determined according to the Default rule.

How it is done in the documentation

Related questions