github-personal/firezone
1
0
Fork 0
mirror of https://github.com/outbackdingo/firezone.git synced 2026-01-27 10:18:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(gateway): only log skipped NAT entry if IP differs (#10285)

Browse Source 
When we resolve a DNS resource domain name on the Gateway, we establish
the mapping between proxy IPs and resolved IPs in order to correctly NAT
traffic. These domains are re-resolved every time the Client sees a DNS
query for it. Thus, established connections could be interrupted if the
IPs returned by consecutive DNS queries are different.

Many SaaS products (GitHub for example) use DNS to load balance between
different IPs. In order to not interrupt those connections, we check
whether we have an open NAT session for an existing mapping every time
we re-resolve DNS.

This log is currently printed too often though because it doesn't take
into account whether the IPs actually changed. If the IP is the same, we
don't need to print this because the update is a no-op.
This commit is contained in:
Thomas Eizinger
2025-09-05 07:12:46 +10:00
committed by GitHub
parent 826a304071
commit ead1f40101
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
rust/connlib/tunnel/src/peer.rs
View File

@@ -148,13 +148,16 @@ impl ClientOnGateway {
let ip_maps = ipv4_maps.chain(ipv6_maps);
for (proxy_ip, real_ip) in ip_maps {
tracing::debug!(%name, %proxy_ip, %real_ip);
if self.nat_table.has_entry_for_inside(*proxy_ip) {
tracing::debug!(%name, %proxy_ip, %real_ip, "Skipping DNS resource NAT entry because we have open NAT sessions for it");
if let Some(state) = self.permanent_translations.get(proxy_ip)
&& self.nat_table.has_entry_for_inside(*proxy_ip)
&& state.resolved_ip != real_ip
{
tracing::debug!(%name, %proxy_ip, new_real_ip = %real_ip, current_real_ip = %state.resolved_ip, "Skipping DNS resource NAT entry because we have open NAT sessions for it");
continue;
}
tracing::debug!(%name, %proxy_ip, %real_ip);
self.permanent_translations
.insert(*proxy_ip, TranslationState::new(resource_id, real_ip));
}