IPsec/NAT-T Load Balancing with RNAT

 


IPsec/NAT-T Load Balancing with RNAT #

General Properties #

This example shows how to load-balance IPsec/NAT-T traffic (IPv4 UDP port 4500) while providing outbound connectivity for the target servers with RNAT.

  • Specifying the same VRRP priority 254 leaves the mastership unspecified. This in turn allows the backup to relearn the session table contents with the bngsync protocol.
  • VRRP and bngsync are going both over interface 2, both nodes need to reference each other as usual (differences are shown in bold).
  • vrrppreempt is active, the vrrppreemptts threshold is set to 10 and VRRP tracking is enabled in the VRRP section. The resulting effect is, that if a VRRP master loses connectivity of interface 1 (trackval set to 20) and the VRRP backup not, the VRRP backup would claim mastership immediately.
  • The sessionid is not specified (the default), sessions will be created based on the client source IP address only.
  • The server load balancing method is rr (round robin), which is now shown explicitely with BalanceNG V7.
  • The targets health-check is arp 2.5 which can now be expressed explicitely as needed.
  • The rnat section at the end specifies the RNAT mappings, translating to the virtual server IP address for outbound connectivity in this case. The resulting RNAT flows with their ephemeral port selection don’t need to be synchronised - they are algorithmically the same anyway.
  • There are 4 packet processing threads specified for each interface (not required, but any theoretically possible multithreading issues would be detectable). The command show threads shows the share percentage per thread.

Node A # 


//        configuration taken Mon Jul 27 14:49:24 2026
//        BalanceNG 7.517 (created 2026/07/21)
hostname  u31
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 172.17.0.0
          mask 255.255.0.0
          real 172.17.11.2
          virt 172.17.11.1
          nat outside
          interface 1
}         
network   2 {
          name "Target Network"
          addr 172.16.0.0
          mask 255.255.0.0
          real 172.16.11.2
          virt 172.16.11.1
          syncpeer 172.16.11.3
          nat inside
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 172.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 172.17.11.100
          port 4500
          protocol udp
          method rr
          targets 100,101
}         
register  server 100
enable    server 100
target    100 {
          ipaddr 172.16.11.100
          port 4500
          protocol udp
          arp 2,5
}
target    101 {
          ipaddr 172.16.11.101
          port 4500
          protocol udp
          arp 2,5
}
register  targets 100,101
enable    targets 100,101
rnat      {
          ::ffff:172.16.11.100 ::ffff:172.17.11.100
          ::ffff:172.16.11.101 ::ffff:172.17.11.100
}
//        end of configuration

Node B # 


//        configuration taken Mon Jul 27 14:49:28 2026
//        BalanceNG 7.517 (created 2026/07/21)
hostname  u30
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 172.17.0.0
          mask 255.255.0.0
          real 172.17.11.3
          virt 172.17.11.1
          nat outside
          interface 1
}         
network   2 {
          name "Target Network"
          addr 172.16.0.0
          mask 255.255.0.0
          real 172.16.11.3
          virt 172.16.11.1
          syncpeer 172.16.11.2
          nat inside
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 172.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 172.17.11.100
          port 4500
          protocol udp
          method rr
          targets 100,101
}         
register  server 100
enable    server 100
target    100 {
          ipaddr 172.16.11.100
          port 4500
          protocol udp
          arp 2,5
}
target    101 {
          ipaddr 172.16.11.101
          port 4500
          protocol udp
          arp 2,5
}
register  targets 100,101
enable    targets 100,101
rnat      {
          ::ffff:172.16.11.100 ::ffff:172.17.11.100
          ::ffff:172.16.11.101 ::ffff:172.17.11.100
}
//        end of configuration