IPsec/NAT-T Load Balancing with RNAT and Highest Random Weight Consistency

 


IPsec/NAT-T Load Balancing with RNAT and Highest Random Weight Consistency #

General Properties #

This example shows how to load-balance IPsec/NAT-T traffic (IPv4 UDP port 4500) while providing outbound connectivity for the target servers with RNAT.

This configuration is perfect to add load-balancing and HA to Secunet SINA L3 high-security infrastructures (in fact the functionality has been implemented and tested for exactly that purpose).

  • Specifying the same VRRP priority 254 leaves the mastership unspecified. This in turn allows the backup to relearn the session table contents with the bngsync protocol.
  • VRRP and bngsync are going both over interface 2, both nodes need to reference each other as usual (differences are shown in bold).
  • vrrppreempt is active, the vrrppreemptts threshold is set to 10 and VRRP tracking is enabled in the VRRP section. The resulting effect is, that if a VRRP master loses connectivity of interface 1 (trackval set to 20) and the VRRP backup not, the VRRP backup would claim mastership immediately.
  • RNAT processing within the module_slb is enabled with set rnatslbenable 1.
  • The sessionid is set to sessionid src+port in the server section and sessionid dst+port in the target sections.
  • The server load balancing method is set to hrw (Highest Random Weight).
  • The targets health-check is arp 2.5 which can now be expressed explicitely as needed.
  • The rnat section at the end specifies the RNAT mappings, translating to the virtual server IP address for outbound connectivity in this case. The resulting RNAT flows with their ephemeral port selection don’t need to be synchronised - they are algorithmically the same anyway.
  • There are 4 packet processing threads specified for each interface (not required, but any theoretically possible multithreading issues would be detectable). The command show threads shows the share percentage per thread.

Node A # 

//        configuration taken Tue Sep  8 08:44:39 2026
//        BalanceNG 7.568 (created 2026/09/08)
hostname  u31
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          rnatslbenable 1
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 172.17.0.0
          mask 255.255.0.0
          real 172.17.11.2
          virt 172.17.11.1
          interface 1
}         
network   2 {
          name "Target Network"
          addr 172.16.0.0
          mask 255.255.0.0
          real 172.16.11.2
          virt 172.16.11.1
          syncpeer 172.16.11.3
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 172.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 172.17.11.100
          port 4500
          protocol udp
          sessionid src+port
          method hrw
          targets 100,101
}         
register  server 100
enable    server 100
target    100 {
          ipaddr 172.16.11.100
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    101 {
          ipaddr 172.16.11.101
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
register  targets 100,101
enable    targets 100,101
rnat      {
          ::ffff:172.16.11.100 ::ffff:172.17.11.100
          ::ffff:172.16.11.101 ::ffff:172.17.11.100
}
//        end of configuration

Node B # 

//        configuration taken Tue Sep  8 08:45:36 2026
//        BalanceNG 7.568 (created 2026/09/08)
hostname  u30
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          rnatslbenable 1
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 172.17.0.0
          mask 255.255.0.0
          real 172.17.11.3
          virt 172.17.11.1
          interface 1
}         
network   2 {
          name "Target Network"
          addr 172.16.0.0
          mask 255.255.0.0
          real 172.16.11.3
          virt 172.16.11.1
          syncpeer 172.16.11.2
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 172.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 172.17.11.100
          port 4500
          protocol udp
          sessionid src+port
          method hrw
          targets 100,101
}         
register  server 100
enable    server 100
target    100 {
          ipaddr 172.16.11.100
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    101 {
          ipaddr 172.16.11.101
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
register  targets 100,101
enable    targets 100,101
rnat      {
          ::ffff:172.16.11.100 ::ffff:172.17.11.100
          ::ffff:172.16.11.101 ::ffff:172.17.11.100
}
//        end of configuration