Why does return traffic have to flow through TR7 in Route Mode?

Short answer

In the Route Mode of the Network vService, TR7 translates the destination address and port of the request from the vService address (VIP) to the IP and port of the Backend Service; the source address remains the client's IP. Since the client connected to the VIP, the source address of the response must be translated back to the VIP, and only TR7 can perform this translation. If the response returns through another router, the client receives packets from a server IP it did not connect to, and the connection cannot be established. For this reason, the servers' default gateway is set to TR7, or the routes to the client networks are defined through TR7.

How Does It Work?

Example: client 198.51.100.45, VIP 192.0.2.100:443, Backend Service 192.0.2.20:8443.

Step	Packet (source → destination)	What TR7 does
1. Client → TR7	198.51.100.45 → 192.0.2.100:443	Selects the Backend Service
2. TR7 → server	198.51.100.45 → 192.0.2.20:8443	Translates the destination address and port
3. Server → TR7	192.0.2.20:8443 → 198.51.100.45	Receives the response (the server's default gateway is TR7)
4. TR7 → client	192.0.2.100:443 → 198.51.100.45	Translates the source address and port back to the VIP

The fourth step happens only when the response passes through TR7. If the response goes directly to the client, the client cannot match the 192.0.2.20:8443 → 198.51.100.45 packet with the 192.0.2.100:443 connection it established and rejects it; a stateful firewall in between also drops a flow of which it sees only one direction.

In TR7

• Default gateway: The server's default gateway is set to TR7's address in the same network as the server; in a cluster, the VIP in this network is used, so that the gateway also moves to the peer device on failover.
• Static route: If the default gateway cannot be changed, the routes to the client networks are defined on the server through TR7.
• Alternative: If these are not possible, SNAT is selected as the LB Mode and the SNAT IP is set on the vService; the client IP is lost, but the return comes to TR7 on its own. For servers on the same L2 network, Direct Server Return also preserves the client IP (What is Direct Server Return (DSR); what preparation is needed on the server side?).
• Scope: Route Mode is applied only on TCP - L4 and UDP - L4 vServices with Port range off; it cannot be selected with Protocol ANY - L3.

Common Misconceptions

• "Route Mode requires the same L2 network." The same L2 is not required; only the return has to pass through TR7.
• "If the health check is successful, the traffic also works." The health check is performed from TR7's own address and its response returns to TR7; the return path of the client traffic is checked separately.
• "In Route Mode, the client IP is lost." It is preserved; it is lost in the SNAT mode.

How it is done in the documentation

• Network vService · Route Mode
• Network vService · LB Mode

Related questions

• Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?
• What is Direct Server Return (DSR); what preparation is needed on the server side?
• Is it possible to work without SNAT (transparent mode); what are the requirements?