I’ve installed a Vyos VM, and outbound loadbalancing works fine.
Inbound connections have a weird behavior though… When an inbound connection comes in, the destination is correctly translated, but the SOURCE is translated as well, and Vyos uses the WAN IP for that…
Assuming:
WAN host 5.4.3.2
LAN server: 192.168.1.5
WAN gateway: 192.168.178.1
Vyos WAN IP: 192.168.178.240
Vyos LAN IP: 192.168.1.240
When I tcpdump the incoming connection on both WAN and LAN interfaces (-i any), I see the following for every packet:
what about using tcpdump on each individual interface to split up the viewing of the flow. it might help narrow down where exactly the problem is happening. you could also check iptables to make sure the VyOS config layer matches the underlying firewall sets.
However, your suggestion to look at the iptables helped resolve my problem, as ‘iptables -L -t nat’ does show IMHO the problem:
Chain WANLOADBALANCE (1 references)
pkts bytes target prot opt in out source destination
89264 5356K SNAT all – any any anywhere anywhere connmark match 0x1 to:10.50.164.240
3916 235K SNAT all – any any anywhere anywhere connmark match 0x2 to:192.168.178.240
So I started looking in to the load-balancing section and found: set load-balancing wan disable-source-nat
This resolved the SNAT on onbound connections issue…