Re: UM with Firewall -Marking
Mattias Andersson <[email protected]> Mon, 21 Aug 2006 12:16:40 +0200
| Newsgroups | gmane.linux.highavailability.ultramonkey |
|---|---|
| Message-ID | <[email protected]> |
Hi John, I never actually read this example before but now I have, thanks. I think that first we want to make two things clear. 1) What is the purpose of the example? To show you how to make more flexible/complex definitions of a virtual service (more then just ip and port) using firewall marks. 2) What do we do following the example? We define a whole /24 network (192.168.0.0-192.168.0.255 (192.168.0.0/24) on any UDP- or TCP-port) as a virtual service using a firewall mark. With that clear it should be quite obvious that our virtual service is not defined for 192.168.6.240 but for the network 192.168.0.0/24. You have to be able to reach, route to, the 192.168.0.0/24 network from the directors (as you say you have configured below), and all other clients you wish to test this from must some how know about the network to.. You can verify you routing config using: /sbin/ip route list 192.168.0.0/24 It should give something like: 192.168.0.0/24 via 192.168.6.240 dev eth0 /Mattias John Joseph skrev: > --- Mattias Andersson <[email protected]> wrote: > > >> Please supply the output of the following commands >> >> Your iptables masq settings: >> (/sbin/iptables -t nat -L -n) >> >> and fwmark settings: >> (/sbin/iptables -t mangle -L -n) >> >> and last your ipvsadm config >> (ipvsadm -L -n) >> >> /Mattias >> >> >> > > Hi > Thanks for the mail , my settings are > > [root@JJ-32-UM-One ~]# iptables -t nat -L -n > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > > Chain POSTROUTING (policy ACCEPT) > target prot opt source destination > MASQUERADE all -- 192.168.7.0/24 0.0.0.0/0 > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > [root@JJ-32-UM-One ~]# > > ***************************************************** > > [root@JJ-32-UM-One ~]# iptables -t mangle -L -n > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > MARK all -- 0.0.0.0/0 > 192.168.0.0/24 MARK set 0x1 > > Chain INPUT (policy ACCEPT) > target prot opt source destination > > Chain FORWARD (policy ACCEPT) > target prot opt source destination > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Chain POSTROUTING (policy ACCEPT) > target prot opt source destination > [root@JJ-32-UM-One ~]# > > ****************************************************** > > [root@JJ-32-UM-One ~]# ipvsadm -L -n > IP Virtual Server version 1.2.0 (size=4096) > Prot LocalAddress:Port Scheduler Flags > -> RemoteAddress:Port Forward Weight > ActiveConn InActConn > FWM 1 rr > -> 192.168.7.5:0 Masq 1 0 > 0 > -> 192.168.7.4:0 Masq 1 0 > 0 > > **************************************************************** > > My Gateway Settings > [root@GW-32 ~]# cat /etc/sysconfig/static-routes > any net 192.168.0.0 netmask 255.255.255.0 gw > 192.168.6.240 > > ****************************** > Thanks > Joseph John > > > > > >> John Joseph skrev: >> >>> --- "Terry, Jason" <[email protected]> wrote: >>> >>> >>> >>>> You may need to add a line into your >>>> /etc/sysconfig/iptables... >>>> >>>> It's been so long I can't remember the command >>>> >> line >> >>>> way to add this. >>>> >>>> However in my iptables file I have an entry >>>> >> similar >> >>>> to this >>>> -A PREROUTING -d 192.168.6.240 -j MARK --set-mark >>>> 0x1 >>>> >>>> >>>> >>> >>> I did it [ forget to mention in the last mail], >>> >> and >> >>> it is not working >>> I suspect , it is the problem with the >>> ldirectord.cf >>> thanks >>> Joseph John >>> >>> >>> >>>> -----Original Message----- >>>> From: [email protected] >>>> [mailto:[email protected]] >>>> >> On >> >>>> Behalf Of John >>>> Joseph >>>> Sent: Thursday, August 17, 2006 3:51 AM >>>> To: UltraMonkey UMMailingList >>>> Subject: UM with Firewall -Marking >>>> >>>> Hi >>>> Thanks to the list , I was success in doing a >>>> test >>>> enviornment for HA-LB >>>> But when I tried to do Firewall-Marked setup I >>>> >> am >> >>>> not >>>> able to set it up >>>> my >>>> ldirectord.cf contains >>>> >>>> # Global Directives >>>> checktimeout=10 >>>> checkinterval=2 >>>> #fallback=127.0.0.1:80 >>>> autoreload=no >>>> logfile="/var/log/ldirectord.log" >>>> logfile="local0" >>>> quiescent=yes >>>> >>>> >>>> # Note: persistancy needs to be turned on if FTP >>>> traffic is to handled >>>> # using LVS-DR (gate) or LVS-TUN (ipip). >>>> >> This >> >>>> is >>>> not neccessary >>>> # or LVS-NAT (masq). >>>> virtual=1 >>>> real=192.168.7.4:0 masq >>>> real=192.168.7.5:0 masq >>>> service=http >>>> checkport=80 >>>> checktype=ping >>>> request="real.html" >>>> receive="Test" >>>> scheduler=rr >>>> #persistent=600 >>>> >>>> my >>>> " ipvsadm -L -n" show the weight of both real >>>> server as "1" >>>> >>>> But when I try to browse for 192.168.6.240 >>>> >> , I >> >>>> cannot get the home page . I had used same setup >>>> from >>>> the ultra-monkey >>>> >>>> >>>> > (http://www.ultramonkey.org/3/topologies/ha-lb-eg-fwmark.html) > >>> >>> >>>> I did some changes in "/etc/ha.d/ldirectord.cf" >>>> which >>>> is given above >>>> >>>> It works fine when I do not use Firewall >>>> marking >>>> Guidance requested >>>> Joseph John >>>> >>>> >>>> >>>> >>>> >>>> > ___________________________________________________________ > >>> >>> >>>> Try the all-new Yahoo! Mail. "The New Version is >>>> radically easier to >>>> use" - The Wall Street Journal >>>> http://uk.docs.yahoo.com/nowyoucan.html >>>> >>>> >>>> -- >>>> Ultra Monkey - http://www.ultramonkey.org/ >>>> To UNSUBSCRIBE, email to [email protected], >>>> >> with >> >>>> a body: >>>> unsubscribe ultramonkey-users >>>> [email protected] >>>> where "[email protected]" is YOUR >>>> >> email >> >>>> address. >>>> >>>> >>>> >>>> -- >>>> Ultra Monkey - http://www.ultramonkey.org/ >>>> To UNSUBSCRIBE, email to [email protected], >>>> >> with >> >>>> a body: >>>> unsubscribe ultramonkey-users >>>> [email protected] >>>> where "[email protected]" is YOUR >>>> >> email >> >>>> address. >>>> >>>> >>>> >>>> >>> >>> >>> >>> > ___________________________________________________________ > >>> Now you can scan emails quickly with a reading >>> >> pane. Get the new Yahoo! Mail. >> http://uk.docs.yahoo.com/nowyoucan.html >> >>> >>> >> -- >> Ultra Monkey - http://www.ultramonkey.org/ >> To UNSUBSCRIBE, email to [email protected], with >> a body: >> unsubscribe ultramonkey-users >> [email protected] >> where "[email protected]" is YOUR email >> address. >> >> >> > > > > > > > ___________________________________________________________ > All new Yahoo! Mail "The new Interface is stunning in its simplicity and ease of use." - PC Magazine > http://uk.docs.yahoo.com/nowyoucan.html > > > -- Ultra Monkey - http://www.ultramonkey.org/ To UNSUBSCRIBE, email to [email protected], with a body: unsubscribe ultramonkey-users [email protected] where "[email protected]" is YOUR email address.