tencent cloud

Feedback

Obtaining Real Client IPs via TOA in Hybrid Cloud Deployment

Last updated: 2024-01-04 14:39:00
    This document describes how the layer-4 (TCP) CLB service obtains the real client IP address via TOA in hybrid cloud deployment and NAT64 CLB scenarios.
    Note:
    Only NAT64 CLB instances in Beijing, Shanghai, and Guangzhou regions can obtain the real client IP address via TOA.
    Only layer-4 (TCP) CLB instances can obtain the real client IP address via TOA, while layer-4 (UDP) and layer-7 (HTTP/HTTPS) CLB instances cannot.
    This feature is in beta testing. To try it out, please submit a ticket.

    Use Cases

    Hybrid cloud deployment

    In hybrid cloud deployment scenarios, IP addresses of the IDC and VPC may overlap, so an SNAT IP address is required. For the server, the real client IP address is invisible and needs to be obtained via TOA.

    NAT64 CLB

    In NAT64 CLB scenarios, the real client IPv6 address is translated to a public IPv4 address, which is invisible to the real server. In this case, the real client IP address can be obtained via TOA, that is, the TCP packets transmit the real client IP address to the server after you insert the real client IP address into the field TCP option, and the client can obtain the real client IP address by calling the API of the TOA kernel module.

    Restrictions

    Enabling TOA in the Console

    1. Create a NAT64 CLB instance. For more information, see Creating IPv6 NAT64 CLB Instances.
    2. Log in to the CLB console and create a TCP listener. For more information, see Configuring TCP Listener.
    3. Enable TOA in the Create listener window.

    Loading TOA

    1. Download and decompress the TOA package corresponding to the version of Linux OS on Tencent Cloud.
    2. After decompression is completed, run the cd command to access the decompressed folder and run the following module loading command:
    insmod toa.ko
    3. Run the following command to check whether TOA has been loaded. If you see the message "toa load success", the loading is successful.
    dmesg -T | grep TOA
    4. After TOA is loaded, load the toa.ko file in the startup script (the toa.ko file needs to be reloaded if the server is restarted).
    5. (Optional) If TOA is no longer needed, run the following command to uninstall it:
    rmmod toa
    6. (Optional) Run the following command to check whether the module is uninstalled. If you see the message "TOA unloaded", the uninstallation is successful.
    dmesg -T
    If you cannot find an installation package above for your OS version, you can download the general source package for Linux OS and compile it to obtain the toa.ko file. This general version supports most Linux distributions (e.g., CentOS 7, CentOS 8, Ubuntu 16.04, and Ubuntu 18.04).
    Note:
    Linux kernels and Linux distributions are varied, and that may cause compatibility issues. We recommend compiling the TOA source package on your OS before using it.
    1. Download the source package.
    Note:
    If your OS is Linux, download the Linux TOA source package; if it is TencentOS, download the TLinux TOA source package.
    Linux
    wget "https://clb-toa-1255852779.file.myqcloud.com/tgw_toa_linux_ver.tar.gz"
    TLinux
    wget "https://clb-toa-1255852779.file.myqcloud.com/tgw_toa_tlinux_ver.tar.gz"
    2. To compile the Linux environment for TOA, you need to install the GCC compiler, Make tool, and kernel development package first.
    3. Change the PATH environment variable to PATH=/opt/rh/devtoolset-8/root/bin:$PATH. Before compiling, make sure that the ‍‍Kernel ‍version matches the GCC version. You can run dmesg | grep 'Linux version' to check the Kernel version.
    4. Compile the source package to generate the toa.ko file. If warning and error are not prompted during the compilation process, the compilation is successful. Take the source package for Linux OS as an example:
    tar zxvf tgw_toa_linux_ver.tar.gz
    cd tgw_toa_linux_ver//Enter the decompressed directory tgw_toa
    make
    5. After the compilation is successful, perform step 2 to load TOA.

    Adapting the Real Sever

    (Optional) Monitoring TOA Status

    To ensure execution stability, this kernel module allows you to monitor status. After inserting the toa.ko kernel module, you can monitor the TOA working status on the host of the container in either of the following ways.

    FAQs

    
    Contact Us

    Contact our sales team or business advisors to help your business.

    Technical Support

    Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

    7x24 Phone Support