Re: What am I missing?
Brad Willson <[email protected]>
| Newsgroups | gmane.linux.highavailability.ultramonkey |
|---|---|
| Organization | UW GeneTests |
| Message-ID | <[email protected]> |
Andersson Mattias wrote: >>[root@beast ~]# ip addr sh >>1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue >> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 >> inet 127.0.0.1/8 brd 127.255.255.255 scope host lo >> inet6 ::1/128 scope host >> valid_lft forever preferred_lft forever >>2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 >> link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff >> inet xxx.xxx.xxx.1/24 brd xxx.xxx.xxx.255 scope global eth0 >> inet xxx.xxx.xxx.42/24 brd xxx.xxx.xxx.255 scope global secondary >>eth0 >> inet6 fe80::202:b3ff:fe19:ed1c/64 scope link >> valid_lft forever preferred_lft forever >>3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 >> link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff >> inet 192.168.7.1/24 brd 192.168.7.255 scope global eth1 >> inet 192.168.7.240/24 brd 192.168.7.255 scope global secondary >> >> >eth1 > > >> inet6 fe80::202:b3ff:fe19:ed1d/64 scope link >> valid_lft forever preferred_lft forever >>4: sit0: <NOARP> mtu 1480 qdisc noop >> link/sit 0.0.0.0 brd 0.0.0.0 >> >>ip route shows the correct upstream gateway, as does route -n. >> >>[root@beast ~]# ip route >>192.168.7.0/24 dev eth1 proto kernel scope link src 192.168.7.1 >>xxx.xxx.xxx.0/24 dev eth0 proto kernel scope link src xxx.xxx.xxx.1 >>169.254.0.0/16 dev eth1 scope link >>default via xxx.xxx.xxx.100 dev eth0 >> >> >> > >This looks right, but also not. >I guess you would like to have the gateway address as the internal >virtual address witch will follow the active director, right. >Well this will work as long as this current machine is you director, if >this one fails and you fail-over to the other one your real server will >still try to use this broken machine as their gateway... >In this particular case this can also break the NAT, read the section >about real servers once again. Yes, read it carefully since it seams to >me it might be a bit confusing. > > > Confusing seems to be the word of the day... I am not clear about which gateway address you're referring to; the gw facing the internet or the gw facing the real servers. The internal gw address of 192.168.7.240 does follow the active director and I have verified this with telnet and ping from real servers back to the active director. No errors result from 'ping yahoo.com' on either of the real servers. I'm 98% certain that the problem lies in iptables, but without a baseline skeleton example, I have few options. I've tried several different configurations ranging from a modified production version to the default 'lokkit' output with masquerading to flushing all tables except for nat containing the rule on the UM website. On another note... I get regular kernel panics with a more restrictive firewall ruleset in place, specifically one that blocks udp traffic between the directors. I have not gathered reports yet, but Horms might recall I mentioned this some time ago. 2.6.9-5.EL #1 Wed Jan 5 19:22:18 EST 2005 i686 i686 i386 GNU/Linux is the kernel in place. >>Any ideas? Are there any other config files that would be helpful to >>diagnose this? >> >>-- >>Brad Willson, Sr. Computer Specialist >>UW GeneTests, UW Box: 358735 >>EM: [email protected] >>W: 206.221.4674, C: 425.891.2732 >>http://www.genetests.org >> >> >>-- >>Ultra Monkey - http://www.ultramonkey.org/ >>To UNSUBSCRIBE, email to [email protected], with a body: >>unsubscribe ultramonkey-users [email protected] >>where "[email protected]" is YOUR email address. >> >> >> >> > > > > > -- Brad Willson, Sr. Computer Specialist UW GeneTests, UW Box: 358735 EM: [email protected] W: 206.221.4674, C: 425.891.2732 http://www.genetests.org -- Ultra Monkey - http://www.ultramonkey.org/ To UNSUBSCRIBE, email to [email protected], with a body: unsubscribe ultramonkey-users [email protected] where "[email protected]" is YOUR email address.