In DNAT mode, when communicating with backend servers, only the destination address is translated from the VIP to the RIP without translating the client source address.
Use case
DNAT mode is suitable for scenarios where backend servers need to be aware of the real client IP address for related analysis.
Network requirement
The DNAT mode of the network load balancer has the following network restrictions:
Backend servers must be L2 reachable from the VIP, and backend servers must not be L2 reachable from clients, to prevent backend servers from sending responses directly to clients.
The default routing gateway of backend servers must be configured as the VIP address of the virtual service.
Address translation process
The following diagram shows the address translation process in DNAT mode:
The client initiates a request packet. The source address in the packet is the CIP, and the destination address is the VIP.
After the load balancer virtual machine receives the client request, DNAT translation is performed: the destination address is translated from the VIP to the RIP, and the source address remains unchanged. At this point, the backend server is aware of the real client IP address.
After the backend server receives and processes the request, it sends a response packet. The source address in the packet is the RIP, and the destination address is the CIP.
After the load balancer virtual machine receives the backend server response, the source address is translated from the RIP to the VIP, and the destination address is the CIP. At this point, the client is not aware of the real IP address of the backend server.
