per machine SNAT

Hi all,

I'm hoping someone might be able to point me in the right direction.

I have a large number of machines (potentially > 65,000) that I need to be able SNAT to particular addresses for particular machines, onto a different network.

Essentially I'm trying to achieve a dynamic DHCP -> fixed address mapping onto a different network for logging and filtering based on ip address. (The easiest way would be to do away with dynamic DHCP but I unfortunately do not have that option. Also I will need to map different networks onto the same network, which also negates the use of static DHCP option.)

One way to do this is to write a custom rule for each machine, eg:

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.100.50 anywhere to: 10.0.0.1
SNAT all -- 192.168.100.17 anywhere to: 10.0.0.2
SNAT all -- 172.16.45.18 anywhere to: 10.0.0.3
...etc...

That's ok for a small number of machines, but performance obviously drops off quickly for large numbers of rules.

I looked at using ipset, but this does seem to be able to be used in this kind of case.

Also, unfortunately there is no algorithmic mapping in this case - the information for the mappings will be stored in a database that will be used to populate the rules.

Can anyone suggest a possible solution? I am willing to write my own GPL'd kernel module (probably based on another that is part way there - e.g. ipset) if that is the answer, but before I throw my effort into that, I'm hoping that someone else might have an idea.

regards
Ramen Sen