Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a load balancing within the same LAN using IPTables (if possible). My idea is to emulate our main load balancer, but within a virtual environment, all the servers are virtual machines by the way.

There is a Gateway server, which forwards traffic to and from the Virtual Servers and the Real World, and I want to use that Gateway to balance some traffic within that Virtual LAN.

My setup is:

  • GatewayServer -> 2 interfaces: eth0(Public), eth2(Private; 10.x.y.0/24)
  • ServerA -> 1 interface: eth2(Private; 10.x.y.0/24)
  • ServerB -> 1 interface: eth2(Private; 10.x.y.0/24)

On ServerB there is 2 instances of a service, listening on ports 60003 and 60004.

My goal is to be able to open a connection from ServerA to GatewayServer:60002 and get balanced to ServerB on ports 60003 and 60004 in a Round Robin fashion.

I've been able to open connections to to ServerB from ServerA through GateWay server, but the connecion always reach ServerB on port 60003, and never the other one, 60004.

I have the Gateway set up this way:

-A POSTROUTING -i eth2 -s 10.x.y.0/24 -p tcp --dport 60002 -j DNAT --to-destination 10.x.y.18-10.x.y.18:60003-60004


Sniffing on ServerB I see the packets comming from GatewayServer, but always hiting port 60003 as stated before.

Any idea?

share|improve this question
Please review the answers to the questions you have already asked and if applicable mark the one that was most useful as accepted. This will help the community know that the questions have useful answers. – Iain Oct 1 '11 at 16:22
up vote 2 down vote accepted

You will need to check the version of the kernel you are running as kernels later than 2.6.11-rc1 have had the functionality you want to use removed. To find your kernel version use uname e.g.

uname -r 

From the iptables man page

In Kernels up to 2.6.10 you can add several --to-destination options. For those kernels, if you specify more than one destination address, either via an address range or multiple --to-destination options, a simple round-robin (one after another in cycle) load balancing takes place between these addresses. Later Kernels (>= 2.6.11-rc1) donât have theability to NAT to multiple ranges anymore.

share|improve this answer
I see. My kernel is 2.6.18-164.15.1.el5xen. so it seems there is nothing I can do. – CarlosH Oct 2 '11 at 6:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.