DTLS Load Balancing

[Sékine Coulibaly]

I've setup a simplisti UDP load balancing as follow :

stream {
  upstream dtls_udp_upstreams {
    hash $remote_addr:remote_port;
    server preprod.mycorp.com:5684;
  }

  server {
    listen 5684 udp;
    proxy_pass dtls_udp_upstreams;
    proxy_responses 1;
  }
}

I notice that the balancing is correctly done and the response is received
by the client. Unfortunately, the destination port on the response reaching
the client is not the initial source port, and as a consequence, the DTLS
frame is discarded and a new DTLS handshake is initiated.

When proxying UDP packets through Nginx, is there a way for Nginx to
preserve its initial source port for subsequent packets?

In my case using Transparent proxying is not possible because my hoster
doesn't allow IP spoofing.

Thank you !
Sekine
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20180124/bde9e4ca/attachment-0001.html>