<p dir="ltr">That is true but load balancer iptables see incoming requests as they are. I'm not sure that this is what you need. What information you wish to receive? Besides the real client IP? </p>
<div class="gmail_quote">12 lip 2013 23:48, "Justin Kinney" <<a href="mailto:jakinne%2B389-users@gmail.com">jakinne+389-users@gmail.com</a>> napisał(a):<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jul 12, 2013 at 2:32 PM, Grzegorz Dwornicki <span dir="ltr"><<a href="mailto:gd1100@gmail.com" target="_blank">gd1100@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Are you doing this on loadbalancer? You can use iptables with log target but if this is not sufficient, then some kind of sniffer like tcpdump might be helpful </p>
</blockquote><div><br></div><div>The loadbalancer will add the client ip address to the TCP options field of the client request prior to passing to the servicing node behind the LB.<br> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_quote">12 lip 2013 23:27, "Rich Megginson" <<a href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a>> napisał(a):<div><div><br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>On 07/12/2013 03:25 PM, Justin Kinney
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>Hello,<br>
<br>
</div>
I'm investigating the possibility of logging client IP address
where 389ds is deployed behind a load balancer. Today, we lose
the true client IP address as the source IP is replaced with
the load balancer's before the packet hits the 389 host. Has
anybody solved this issue before?<br>
<br>
</div>
<div>For HTTP based services, this problem is trivial to
overcome by grokking the X-Forwarded-For header from the
request, but obviously this doesn't work with a service like
LDAP deployed behind a TCP based load balancing instance.<br>
</div>
<div><br>
</div>
<div>One option is to use a direct server return (DSR)
configuration with our load balancer and host, but that adds a
lot of overhead to our environment in terms of configuration
complexity, so I'd like to avoid that.<br>
<br>
</div>
<div>Another option is using an interesting capability of our
load balancer (and I'm not sure how unique this feature is -
I'd be interested in hearing if anyone else has run across
it). It can insert the client IP address into the TCP stream,
as arbitrary data in the options field of the TCP header.
Existence of an address is also indicated by a magic number
(which can uniquely identify the VIP on the load balancer).<br>
<br>
</div>
What would it take to modify 389 to access the raw TCP header,
parse the options field to get the true client IP, and then
associate it with the request? Ideally, the client IP would be
accessible in the access log.<br>
</div>
</blockquote>
<br>
I don't know - what are the TCP/IP/socket API calls that are
required to get this data?<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<br>
Thanks in advance,<br>
Justin</div>
<br>
<fieldset></fieldset>
<br>
<pre>--
389 users mailing list
<a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.org</a>
<a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a></pre>
</blockquote>
<br>
</div>
<br>--<br>
389 users mailing list<br>
<a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.org</a><br>
<a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><br></blockquote></div></div></div>
<br>--<br>
389 users mailing list<br>
<a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.org</a><br>
<a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><br></blockquote></div><br></div></div>
<br>--<br>
389 users mailing list<br>
<a href="mailto:389-users@lists.fedoraproject.org">389-users@lists.fedoraproject.org</a><br>
<a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><br></blockquote></div>