Gateway Mode - Spoofing

Gateway Mode - Spoofing is the deployment that delivers the result offered by Gateway Mode without touching the server's settings (on the Backend Service, the SNAT field is Use Client IP and Spoofing is on; the server's gateway setting stays as it is). TR7 connects to the server with the client's real IP address; the server's response sets out toward the gateway and TR7 picks up this response on the same network.

No setting change is required on the server: the gateway, address and routing settings stay the same. Preserving the client address stops being a work item on the server side and becomes a feature on TR7, turned on with the Spoofing switch in the Backend Service form. Because both the request and the response pass through TR7, this deployment is also known in the industry as an inline or transparent deployment.

HTTP or TCP?

On HTTP vServices, the X-Forwarded-For header should be used first to pass the client address to the Backend Service, and on HTTP and L7 TCP vServices, Proxy Protocol should be used where the Backend Service supports it; these two methods pass the client address to the server without touching the network design. Gateway Mode - Spoofing is mostly preferred on L7 TCP vServices, that is, where the client address cannot be carried in a header and the application does not support Proxy Protocol.

Real IP

Source address preserved

The server sees the client's own IP address as the source of the connection

Server Settings Unchanged

Gateway stays the same

The server's gateway, address and routing settings are not changed

On TR7

Spoofing

The feature is turned on in the Backend Service form; TR7 itself provides the return path

HTTP and TCP

No header needed

On HTTP and L7 TCP vServices, the client address is carried in the connection itself

Per Service

Applied selectively

It is turned on only for the servers of the selected Backend Services; other servers are not affected

Cluster

Moves together with the VIP

When Spoofing IP VIP Condition binds it to a VIP, the task runs on the device where the VIP is active

Gateway Mode - Spoofing

The diagram shows the flow of traffic: the VIP to which the client connects, TR7 and the Backend Service are on the same interface (1G-1 in the diagram) and in the same network; the client comes from another network (x.x.x.x in the diagram). The default gateway of the Backend Service has not changed: it is not TR7 but the network's own gateway (172.16.102.1).

In the diagram's example, TR7 connects to the Backend Service not with its own address but with the client's address (x.x.x.x); whichever device is active, the Backend Service sees the client's address as the source of the connection. The Backend Service sends the response out toward the client's address, to be delivered through its own gateway (172.16.102.1); since Spoofing is on, the active TR7 in the same network picks up the packet. Since the VIP (172.16.102.92) is selected in the Spoofing IP VIP Condition field, this task runs on the device where the VIP is active and moves to the other device together with the VIP.

The health check is performed not with the client address but with the TR7 address in the Backend Service's route table: in the diagram's example, the active device uses 172.16.102.90 and the other device uses 172.16.102.91. This applies while the Health Check Source IP field of the Backend Service is at its default value; when another address is selected in the field, the check is performed from that address.

In the diagram's example, the source and destination details of the packets in the four steps of the connection are as follows:

Step	Direction	Source IP	Source Port	Destination IP	Destination Port
1	Client → TR7	`x.x.x.x` (Client IP)	Random	`172.16.102.92` (VIP)	`443`
2	TR7 → Backend Service	`x.x.x.x` (Client IP)	Random	`172.16.102.161`	`8080`
3	Backend Service → TR7	`172.16.102.161`	`8080`	`x.x.x.x` (Client IP); the server's gateway is `172.16.102.1`, the active TR7 picks up the packet with Spoofing	Source port of step 2
4	TR7 → Client	`172.16.102.92` (VIP)	`443`	`x.x.x.x` (Client IP)	Source port of step 1

Color	Meaning
	Request
	Response

The packet addresses are the same as in Gateway Mode; the difference is in step 3: there, the server's gateway setting brings the response to TR7; here, the server's setting does not change and Spoofing brings the response to TR7.

Why Gateway Mode - Spoofing?

Gateway Mode	With Gateway Mode - Spoofing
The default gateway is changed to TR7 on each server.	The gateway setting of the servers stays as it is.
The change requires planning by the server team and a maintenance window.	The feature is turned on on TR7; there is no setting to change on the server.
The same setting is applied one by one on many servers.	The setting is made on TR7, in the Backend Service form.
To roll back, the gateway of the servers is changed back to the old address.	On rollback, there is no setting to revert on the server side.

How Does Traffic Flow?

ClientReaches the application at the vService address

RequestTo the vService addressResponseFrom the vService address

TR7Provides the return path itselfTLSBot/DDoSLBWAFAGSWAF and AGS on HTTP vServices only

RequestWith the client's addressResponseToward the gateway; TR7 picks it up

Backend ServiceGateway setting does not change

Request arrivesThe client connects to the vService address at which the application is published.
TR7 inspectsTLS termination, Bot/DDoS and rules are applied at the same point; on HTTP vServices, WAF and AGS are also at this point.
Forwards on behalf of the clientTR7 connects to the selected Backend Service using the client's IP address as the source address.
Response returnsThe Backend Service sends the response toward its own gateway; TR7 picks up this response in the server's network and forwards it to the client.

RequestResponse

The server's settings have not changed: it sends its response to the gateway as always. Bringing the return path to the right device is TR7's job; for this, TR7, the Backend Service and the server's gateway are in the same network.

Highlights

No setting change on the serverThe gateway, address and routing settings stay the same; there is no setting to change on the server.

Real client address end to endThe client's own IP address appears in the Backend Service's logs, access controls and rate limits.

Turned on in the Backend Service formSpoofing is displayed when Use Client IP is selected in the Backend Service form and is enabled with a switch.

Target address is found automaticallyWhen no specific address is given, TR7 takes the default gateway in the Backend Service's route table as the basis; if the server's gateway differs from it, the address is entered in the Spoofing IP field.

Selected per serviceIt applies only to the servers of the Backend Services on which it is turned on; the traffic of other servers in the same network stays on its own path.

Not dependent on headersX-Forwarded-For works only in HTTP; this deployment preserves the client address at the connection level and also applies to L7 TCP vServices.

Server's gateway traffic under controlThe traffic between the server and the gateway passes through TR7 in both directions; this transit is closed by default and is opened with FORWARD rules defined in the firewall.

Moves together with the VIP in a clusterWith Spoofing IP VIP Condition, the feature is bound to a VIP and runs on the device where the VIP is active; when the VIP moves to the other device, the task moves with it. When the field is left empty, the task runs only on the device selected in the Spoofing Default Device field.

When Is It Preferred?

Environments where the server cannot be modified Hands-off

If the servers are managed by another team or a vendor and the gateway cannot be changed, the client address is still preserved.

Multi-server services Operational ease

Instead of changing the gateway one by one on dozens of servers, the feature is turned on on TR7, in the Backend Service definition; the gateway setting is not touched on newly added servers either.

Quick rollout and trial Easy rollback

The effect of Gateway Mode is tried without making a permanent change on the server side; when it is abandoned, no setting remains to be reverted on the server.

Requirements of this deployment

Same network: TR7 has an address in the same network as the Backend Service and the server's gateway; without this address, the feature does not work.
Gateway address: a default gateway must be defined in the Backend Service's route table, or the Spoofing IP field must be filled in.
The client must be in another network: the response to clients in the same network as the server does not go to the gateway and therefore does not return to TR7.
All of the server's gateway traffic passes through TR7: not only the vService traffic but also the connections initiated by the server itself and the access to the server from other networks (management, monitoring, backup) reach TR7. This forwarding is closed by default in TR7's firewall; rules for this traffic must be planned before the feature is turned on.
Network infrastructure: if protections against address spoofing are enabled on the switches or the virtualization platform, a permission may need to be defined for the port to which TR7 is connected.

If the return path is to be provided on the network side

If the return path is to be provided on the network side with a routing rule, the Route Mode deployment is used.

Gateway Mode

The deployment in which the same result is achieved by setting the server's gateway to TR7.

→

Backend Services

Use Client IP, Spoofing, Spoofing IP and cluster options.

→

Firewall

Forwarding (FORWARD) rules for the server's access to other networks.

→

Inline Mode