Re: UM with Firewall -Marking

--- Mattias Andersson <[email protected]> wrote:

> Please supply the output of the following commands
> 
> Your iptables masq settings:
> (/sbin/iptables -t nat -L -n)
> 
> and fwmark settings:
> (/sbin/iptables -t mangle -L -n)
> 
> and last your ipvsadm config
> (ipvsadm -L -n)
> 
> /Mattias
> 
> 

Hi 
   Thanks for the mail , my settings are

[root@JJ-32-UM-One ~]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  192.168.7.0/24       0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@JJ-32-UM-One ~]#

*****************************************************

[root@JJ-32-UM-One ~]# iptables -t mangle -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
MARK       all  --  0.0.0.0/0           
192.168.0.0/24      MARK set 0x1

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
[root@JJ-32-UM-One ~]#

******************************************************

[root@JJ-32-UM-One ~]# ipvsadm -L -n
IP Virtual Server version 1.2.0 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight
ActiveConn InActConn
FWM  1 rr
  -> 192.168.7.5:0                Masq    1      0    
     0
  -> 192.168.7.4:0                Masq    1      0    
     0

****************************************************************

My Gateway Settings 
[root@GW-32 ~]# cat /etc/sysconfig/static-routes
any net 192.168.0.0 netmask 255.255.255.0 gw
192.168.6.240

******************************
                          Thanks 
                             Joseph John 




> John Joseph skrev:
> > --- "Terry, Jason" <[email protected]> wrote:
> >
> >   
> >> You may need to add a line into your
> >> /etc/sysconfig/iptables...
> >>
> >> It's been so long I can't remember the command
> line
> >> way to add this.
> >>
> >> However in my iptables file I have an entry
> similar
> >> to this
> >> -A PREROUTING -d 192.168.6.240 -j MARK --set-mark
> >> 0x1
> >>
> >>     
> >  
> >  I did it [ forget to mention in the last mail],
> and
> > it is not working 
> >         I suspect , it is the problem with the
> > ldirectord.cf
> >            thanks
> >                Joseph John 
> >
> >   
> >> -----Original Message-----
> >> From: [email protected]
> >> [mailto:[email protected]]
> On
> >> Behalf Of John
> >> Joseph
> >> Sent: Thursday, August 17, 2006 3:51 AM
> >> To: UltraMonkey UMMailingList
> >> Subject: UM with Firewall -Marking 
> >>
> >> Hi 
> >>     Thanks to the list , I was success in doing a
> >> test
> >> enviornment for  HA-LB 
> >> But when I tried to do  Firewall-Marked setup I
> am
> >> not
> >> able to set it up 
> >> my   
> >> ldirectord.cf contains
> >>
> >> # Global Directives
> >> checktimeout=10
> >> checkinterval=2
> >> #fallback=127.0.0.1:80
> >> autoreload=no
> >> logfile="/var/log/ldirectord.log"
> >> logfile="local0"
> >> quiescent=yes
> >>
> >>
> >> # Note: persistancy needs to be turned on if FTP
> >> traffic is to handled
> >> #       using LVS-DR (gate) or LVS-TUN (ipip).
> This
> >> is
> >> not neccessary
> >> #       or LVS-NAT (masq).
> >> virtual=1
> >>         real=192.168.7.4:0 masq
> >>         real=192.168.7.5:0 masq
> >>         service=http
> >>         checkport=80
> >>         checktype=ping
> >>         request="real.html"
> >>         receive="Test"
> >>         scheduler=rr
> >>         #persistent=600
> >>
> >>  my  
> >>   " ipvsadm -L -n"  show the weight of both real
> >> server as "1" 
> >>
> >>      But when I try to browse for  192.168.6.240
> , I
> >> cannot get the home page . I had used same setup
> >> from
> >> the ultra-monkey
> >>
> >>     
> >
>
(http://www.ultramonkey.org/3/topologies/ha-lb-eg-fwmark.html)
> >   
> >> I did some changes in  "/etc/ha.d/ldirectord.cf"
> >> which
> >> is given above 
> >>   
> >>         It works fine when I  do not use Firewall
> >> marking 
> >>           Guidance requested
> >>                             Joseph John 
> >>
> >>
> >> 		
> >>
> >>     
> >
>
___________________________________________________________
> >   
> >> Try the all-new Yahoo! Mail. "The New Version is
> >> radically easier to
> >> use" - The Wall Street Journal 
> >> http://uk.docs.yahoo.com/nowyoucan.html
> >>
> >>
> >> -- 
> >> Ultra Monkey - http://www.ultramonkey.org/
> >> To UNSUBSCRIBE, email to [email protected],
> with
> >> a body:
> >> unsubscribe ultramonkey-users
> >> [email protected]
> >> where "[email protected]" is YOUR
> email
> >> address.
> >>
> >>
> >>
> >> -- 
> >> Ultra Monkey - http://www.ultramonkey.org/
> >> To UNSUBSCRIBE, email to [email protected],
> with
> >> a body:
> >> unsubscribe ultramonkey-users
> >> [email protected]
> >> where "[email protected]" is YOUR
> email
> >> address.
> >>
> >>
> >>     
> >
> >
> >
> > 		
> >
>
___________________________________________________________
> 
> > Now you can scan emails quickly with a reading
> pane. Get the new Yahoo! Mail.
> http://uk.docs.yahoo.com/nowyoucan.html
> >
> >
> >   
> 
> 
> -- 
> Ultra Monkey - http://www.ultramonkey.org/
> To UNSUBSCRIBE, email to [email protected], with
> a body:
> unsubscribe ultramonkey-users
> [email protected]
> where "[email protected]" is YOUR email
> address.
> 
> 



	
	
		
___________________________________________________________ 
All new Yahoo! Mail "The new Interface is stunning in its simplicity and ease of use." - PC Magazine 
http://uk.docs.yahoo.com/nowyoucan.html


-- 
Ultra Monkey - http://www.ultramonkey.org/
To UNSUBSCRIBE, email to [email protected], with a body:
unsubscribe ultramonkey-users [email protected]
where "[email protected]" is YOUR email address.