Meta tags:
description= Tutorial about how to use UDP with regional external passthrough Network Load Balancers.;
Headings (most frequently used words):
the, use, udp, with, load, to, regional, external, passthrough, network, and, balancer, ip, address, balancers, stay, organized, collections, save, categorize, content, based, on, your, preferences, about, an, issue, return, packets, solving, problem, what, next, nat, policy, in, backend, server, nftables, statelessly, mangle, header, fields, let, app, explicitly, bind, recvmsg, sendmsg, instead, of, recvfrom, sendto, specify, products, pricing, support, resources, engage,
Text of the page (most frequently used words):
the (175), load (100), balancer (65), and (60), #address (55), set (46), backend (44), with (35), cloud (32), udp (32), overview (32), #external (29), backends (29), use (28), packets (25), network (22), regional (21), neg (21), that (20), balancers (19), kernel (18), group (18), this (17), socket (17), instance (17), for (15), google (15), are (15), passthrough (15), you (15), app (15), balancing (15), host (14), from (13), following (13), server (13), hybrid (13), zonal (13), traffic (12), source (12), 198 (12), 100 (12), global (12), management (12), port (11), add (11), 128 (11), scope (11), other (10), information (10), 60002 (10), nat (10), based (10), client (10), tcp (10), service (10), application (10), managed (10), internal (9), can (9), using (9), 127 (9), buckets (9), custom (9), architecture (8), code (8), example (8), addr (8), destination (8), local (8), packet (8), forever (8), src (8), ssl (8), resources (7), thumb (7), solution (7), incoming (7), which (7), target (7), connection (7), dev (7), proto (7), storage (7), url (7), proxy (7), negs (7), internet (7), mtls (7), capabilities (7), https (7), about (6), how (6), not (6), multiple (6), loop_on_socket (6), bind (6), sock (6), shows (6), only (6), linux (6), nftables (6), used (6), apps (6), rules (6), returning (6), eth0 (6), iptables (6), protocol (6), link (6), serverless (6), premises (6), cross (6), shared (6), vpc (6), http (6), run (6), more (5), policies (5), configure (5), calls (5), sendmsg (5), recvmsg (5), echo (5), sendto (5), recvfrom (5), process (5), stateless (5), table (5), dnat (5), doesn (5), rewrite (5), examples (5), view (5), 203 (5), 113 (5), forwarding (5), troubleshooting (5), metrics (5), monitor (5), troubleshoot (5), redirect (5), português (4), español (4), support (4), down (4), content (4), there (4), when (4), cons (4), pros (4), type (4), instead (4), data (4), addresses (4), because (4), does (4), change (4), postrouting (4), rule (4), header (4), outgoing (4), response (4), 40695 (4), length (4), compute (4), engine (4), each (4), routing (4), valid_lft (4), preferred_lft (4), broadcast (4), tools (4), maps (4), ipv6 (4), services (4), certificates (4), logs (4), terraform (4), region (4), create (4), headers (4), samples (3), all (3), problem (3), need (3), last (3), send (3), technique (3), next (3), program (3), demonstrates (3), sock_dgram (3), socketkind (3), __main__ (3), __name__ (3), ctl (3), utf8 (3), encode (3), 1500 (3), true (3), while (3), def (3), import (3), usr (3), bin (3), python3 (3), these (3), them (3), preceding (3), also (3), know (3), like (3), translates (3), nft (3), raw (3), command (3), stateful (3), connections (3), return (3), policy (3), diagram (3), document (3), languages (3), hosting (3), solutions (3), sent (3), device (3), have (3), interface (3), work (3), dsr (3), servers (3), directly (3), entry (3), state (3), brd (3), 255 (3), user (3), guides (3), networking (3), health (3), connectivity (3), tls (3), frontend (3), explore (3), tutorials (3), connected (3), networks (3), directory (3), registration (3), distribution (3), migrate (3), classic (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), sign (2), third (2), terms (2), site (2), youtube (2), started (2), system (2), pricing (2), see (2), products (2), understand (2), updated (2), 2026 (2), utc (2), licensed (2), under (2), its (2), developers (2), license (2), feedback (2), read (2), behind (2), maglev (2), changes (2), some (2), might (2), same (2), order (2), fetch (2), must (2), ip_pktinfo (2), setsockopt (2), struct (2), comparison (2), ancillary (2), control (2), messages (2), lets (2), real (2), sending (2), simple (2), back (2), received (2), where (2), bound (2), dns (2), print (2), python (2), your (2), explicitly (2), extra (2), cpu (2), resource (2), consumption (2), required (2), saddr (2), mangle (2), than (2), high (2), two (2), first (2), result (2), means (2), dport (2), options (2), written (2), uses (2), check (2), output (2), tcpdump (2), gateway (2), however (2), previously (2), between (2), has (2), called (2), then (2), clients (2), routes (2), root (2), loopback (2), lower_up (2), mtu (2), qdisc (2), default (2), qlen (2), inet (2), inet6 (2), fe80 (2), deliver (2), maintain (2), tuple (2), dest (2), datagram (2), documentation (2), sdk (2), frameworks (2), infrastructure (2), costs (2), usage (2), access (2), security (2), observability (2), monitoring (2), migration (2), industry (2), distributed (2), multicloud (2), databases (2), analytics (2), pipelines (2), development (2), logging (2), pools (2), tags (2), checks (2), optimizations (2), authorization (2), workload (2), identity (2), failover (2), protocols (2), concepts (2), pool (2), convert (2), capacity (2), over (2), web (2), request (2), functions (2), error (2), constraints (2), console (2), product (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, decade, climate, action, join, manage, cookies, privacy, tech, twitter, events, blog, engage, training, certification, center, getting, github, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, otherwise, noted, page, details, java, registered, trademark, oracle, affiliates, apache, creative, commons, attribution, learn, distribute, what, requires, make, complex, cases, possible, works, even, both, configured, call, option, optname, level, ipproto_ip, contains, 1024, flg, handle, along, payload, include, those, replies, specify, achieved, echoes, bytes, pay, attention, lines, name, setting, specific, binding, modify, binds, operation, let, available, newer, versions, distros, centos, cannot, translation, much, lower, chain, filter, hook, priority, sport, 300, commands, mangling, consumes, fewer, version, greater, statelessly, fields, supports, memory, adds, bypasses, come, isn, affected, second, tracks, rewrites, automatically, prerouting, core, idea, match, but, most, programming, note, solve, several, accomplish, approach, take, approaches, solving, point, coming, causes, problems, drops, gets, rejects, mismatches, 072787, 344148, side, look, after, leave, another, should, 758029, 758396, during, conversation, recall, objects, created, don, relation, fill, goes, certain, slight, difference, treats, needs, including, recorded, structure, represents, thus, correctly, issue, processed, distributes, through, transmits, untouched, correct, noqueue, unknown, multicast, ether, 4001, aff, 1000, 1460, 65536, agent, responsible, adding, actually, owns, daemon, they, intact, direct, virtual, machine, running, destined, controller, nic, benefit, why, scenarios, part, transport, layer, therefore, independent, fact, participants, usually, recognize, commonly, described, implements, unreliable, improves, experience, speed, stream, quic, rfc, 768, discusses, intended, operators, administrators, save, categorize, preferences, stay, organized, collections, home, clean, setup, audit, operate, map, size, quota, units, proxies, subnets, endpoint, groups, names, firewall, draining, advanced, customize, post, quantum, authenticated, private, provided, mutual, encryption, self, secure, switch, deploy, hub, spoke, hop, common, party, appliances, hops, affinity, weighted, testing, optimize, latency, published, domain, faster, performance, improved, protection, multi, best, practices, fail, availability, query, parameter, roll, responses, project, bucket, organization, iam, conditions, roles, permissions, get, feature, model, choose, discover, start, free, skip, main,
Text of the page (random words):
backend services set up custom header and query parameter based routing set up url redirect set up http to https redirect set up url rewrite set up regional load balancer managed vm instance group backend cloud storage backend buckets cloud run backends serverless neg on premises or other cloud backends zonal and hybrid neg external backend internet neg add capabilities traffic management overview set up traffic management set up high availability set up http to https redirect set up a load balancer with backend service using shared vpc set up a load balancer with backend buckets using shared vpc create custom headers in url maps fail over to regional load balancers monitor and troubleshoot overview global load balancers regional load balancers troubleshooting best practices explore tutorials request routing to a multi region external https load balancer faster web performance and improved web protection for load balancing deliver http and https content over the same published domain optimize application latency with load balancing application capacity optimizations with global load balancing capacity management with load balancing internal load balancer architecture overview set up cross region load balancer managed vm instance group backend cloud storage backend buckets on premises or other cloud backends zonal and hybrid neg cloud run backends serverless neg set up regional load balancer terraform examples vm instance group backends cloud run backends serverless neg cloud storage backend buckets on premises or other cloud backends zonal and hybrid neg external backend internet neg add capabilities traffic management overview set up traffic management set up http to https redirect create custom headers in url maps set up regional internal load balancer with backend service using shared vpc set up cross region load balancer with backend buckets using shared vpc set up a regional internal application load balancer with backend buckets using shared vpc service directory registration load balancing and connected networks monitor and troubleshoot view logs and metrics troubleshooting convert load balancer to ipv6 use custom metrics load testing backends proxy network load balancer tcp ssl proxy overview external load balancer architecture overview set up global load balancer global ssl proxy with vm instance group backends global tcp proxy with vm instance group backends set up global load balancer classic terraform examples global ssl proxy with vm instance group backends global tcp proxy with vm instance group backends set up regional load balancer vm instance group backends zonal neg backends hybrid connectivity hybrid negs external backend internet neg internal load balancer architecture overview set up cross region load balancer managed vm instance group backends on premises or other cloud backends zonal and hybrid neg set up regional load balancer managed vm instance group backends zonal neg backends hybrid connectivity hybrid negs external backend internet neg add capabilities load balancing and connected networks monitor and troubleshoot view logs and metrics convert load balancer to ipv6 passthrough network load balancer tcp udp overview external load balancer backend service based architecture traffic distribution concepts target pool based architecture set up load balancer vm instance group backends tcp udp only vm instance group backends multiple protocols zonal neg backends target pool based load balancer add capabilities configure failover configure weighted load balancing migrate from target pools to backend services service directory registration explore tutorials use udp with network load balancers monitor and troubleshoot view logs and metrics troubleshooting internal load balancer architecture overview traffic distribution concepts set up load balancer terraform examples vm instance group backends vm instance group backend for multiple protocols zonal neg backends add capabilities configure failover zonal affinity load balancers as next hops overview set up load balancing for third party appliances forwarding rules that use a common ip address service directory registration load balancing and connected networks explore tutorials set up load balancer as next hop with tags deploy a hub and spoke network set up a load balancer with internal ipv6 only backends monitor and troubleshoot view logs and metrics troubleshooting protocol forwarding overview set up protocol forwarding switch between a target instance and a backend service secure ssl certificates overview use self managed ssl certificates use google managed ssl certificates encryption to the backends troubleshooting ssl policies overview use ssl policies mutual tls frontend mtls overview set up frontend mtls with user provided certificates set up frontend mtls with a private ca backend mtls overview set up backend authenticated tls set up backend mtls backend mtls with managed workload identity overview set up backend mtls using managed workload identity post quantum tls authorization policies overview set up authorization policies customize load balancer advanced load balancing optimizations backend buckets backend services connection draining firewall rules forwarding rules health checks overview use health checks internal dns names ipv6 network endpoint groups overview hybrid connectivity negs internet negs serverless negs zonal negs overview set up zonal negs proxy only subnets tags target pools target proxies url maps overview use url maps url map size and quota units operate and maintain audit logging information health check logging information clean up a load balancer setup ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation networking load balancing guides send feedback use udp with regional external passthrough network load balancers stay organized with collections save and categorize content based on your preferences this document discusses how to work with regional external passthrough network load balancers by using the user datagram protocol udp the document is intended for app developers app operators and network administrators about udp udp is used commonly in apps the protocol which is described in rfc 768 implements a stateless unreliable datagram packet service for example google s quic protocol improves the user experience by using udp to speed up stream based apps the stateless part of udp means that the transport layer doesn t maintain a state therefore each packet in a udp connection is independent in fact there is no real connection in udp instead its participants usually use a 2 tuple ip port or a 4 tuple src ip src port dest ip dest port to recognize each other like tcp based apps udp based apps can also benefit from a load balancer which is why regional external passthrough network load balancers are used in udp scenarios regional external passthrough network load balancer regional external passthrough network load balancers are passthrough load balancers they process incoming packets and deliver them to backend servers with the packets intact the backend servers then send the returning packets directly to the clients this technique is called direct server return dsr on each linux virtual machine vm running on compute engine that is a backend of a google cloud regional external passthrough network load balancer an entry in the local routing table routes traffic that s destined for the load balancer s ip address to the network interface controller nic the following example demonstrates this technique root backend server ip ro ls table local local 10 128 0 2 dev eth0 proto kernel scope host src 10 128 0 2 broadcast 10 128 0 2 dev eth0 proto kernel scope link src 10 128 0 2 local 198 51 100 2 dev eth0 proto 66 scope host broadcast 127 0 0 0 dev lo proto kernel scope link src 127 0 0 1 local 127 0 0 0 8 dev lo proto kernel scope host src 127 0 0 1 local 127 0 0 1 dev lo proto kernel scope host src 127 0 0 1 broadcast 127 255 255 255 dev lo proto kernel scope link src 127 0 0 1 in the preceding example 198 51 100 2 is the load balancer s ip address the google network daemon service agent is responsible for adding this entry however as the following example shows the vm does not actually have an interface that owns the load balancer s ip address root backend server ip ad ls 1 lo loopback up lower_up mtu 65536 qdisc noqueue state unknown group default qlen 1 link loopback 00 00 00 00 00 00 brd 00 00 00 00 00 00 inet 127 0 0 1 8 scope host lo valid_lft forever preferred_lft forever inet6 1 128 scope host valid_lft forever preferred_lft forever 2 eth0 broadcast multicast up lower_up mtu 1460 qdisc mq state up group default qlen 1000 link ether 42 01 0a 80 00 02 brd ff ff ff ff ff ff inet 10 128 0 2 32 brd 10 128 0 2 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80 4001 aff fe80 2 64 scope link valid_lft forever preferred_lft forever the regional external passthrough network load balancer transmits the incoming packets with the destination address untouched to the backend server the local routing table entry routes the packet to the correct app process and the response packets from the app are sent directly to the client the following diagram shows how regional external passthrough network load balancers work the incoming packets are processed by a load balancer called maglev which distributes the packets to the backend servers outgoing packets are then sent directly to the clients through dsr an issue with udp return packets when you work with dsr there is a slight difference between how the linux kernel treats tcp and udp connections because tcp is a stateful protocol the kernel has all the information it needs about the tcp connection including the client address client port server address and server port this information is recorded in the socket data structure that represents the connection thus each returning packet of a tcp connection has the source address correctly set to the server address for a load balancer that address is the load balancer s ip address recall that udp is stateless however so the socket objects that are created in the app process for udp connections don t have the connection information the kernel doesn t have the information about the source address of an outgoing packet and it doesn t know the relation to a previously received packet for the packet s source address the kernel can only fill in the address of the interface that the returning udp packet goes to or if the app previously bound the socket to a certain address the kernel uses that address as the source address the following code shows a simple echo program usr bin python3 import socket struct def loop_on_socket s while true d addr s recvfrom 1500 print d addr s sendto echo encode utf8 d addr if __name__ __main__ host port 0 0 0 0 60002 sock socket socket type socket socketkind sock_dgram sock bind host port loop_on_socket sock following is the tcpdump output during a udp conversation 14 50 04 758029 ip 203 0 113 2 40695 198 51 100 2 60002 udp length 3 14 50 04 758396 ip 10 128 0 2 60002 203 0 113 2 40695 udp length 2t 198 51 100 2 is the load balancer s ip address and 203 0 113 2 is the client ip address after the packets leave the vm another nat device a compute engine gateway in the google cloud network translates the source address to the external address the gateway doesn t know which external address should be used so only the vm s external address not the load balancer s can be used from the client side if you check the output from tcpdump the packets from the server look like the following 23 05 37 072787 ip 203 0 113 2 40695 198 51 100 2 60002 udp length 5 23 05 37 344148 ip 198 51 100 3 60002 203 0 113 2 40695 udp length 4 198 51 100 3 is the vm s external ip address from the client s point of view the udp packets are not coming from an address that the client sent them to this causes problems the kernel drops these packets and if the client is behind a nat device so does the nat device as a result the client app gets no response from the server the following diagram shows this process where the client rejects returning packets because of address mismatches solving the udp problem to solve the no response problem you must rewrite the source address of outgoing packets to the load balancer s ip address at the server that s hosting the app following are several options that you can use to accomplish this header rewrite the first solution uses a linux based approach with iptables the other solutions take app based approaches note the last two examples in this document are written in python 3 but can be written in most programming languages the following diagram shows the core idea of these options rewrite the source ip address of the returning packets in order to match the load balancer s ip address use nat policy in the backend server the nat policy solution is to use the linux iptables command to rewrite the destination address from the load balancer s ip address to the vm s ip address in the following example you add an iptables dnat rule to change the destination address of the incoming packets iptables t nat a postrouting j return d 10 128 0 2 p udp dport 60002 iptables t nat a prerouting j dnat to destination 10 128 0 2 d 198 51 100 2 p udp dport 60002 this command adds two rules to the nat table of the iptables system the first rule bypasses all incoming packets that target the local eth0 address as a result traffic that doesn t come from the load balancer isn t affected the second rule changes the destination ip address of incoming packets to the vm s internal ip address the dnat rules are stateful which means that the kernel tracks the connections and rewrites the returning packets source address automatically pros cons the kernel translates the address with no change required to apps extra cpu is used to do the nat and because dnat is stateful memory consumption might also be high supports multiple load balancers use nftables to statelessly mangle the ip header fields in the nftables solution you use the nftables command to mangle the source address in the ip header of outgoing packets this mangling is stateless so it consumes fewer resources than using dnat to use nftables you need a linux kernel version greater than 4 10 you use the following commands nft add table raw nft add chain raw postrouting type filter hook postrouting priority 300 nft add rule raw postrouting ip saddr 10 128 0 2 udp sport 60002 ip saddr set 198 51 100 2 pros cons the kernel translates the address with no change required to apps does not support multiple load balancers the address translation process is stateless so resourc...
|
