Re: UM with Firewall -Marking

--- Mattias Andersson <[email protected]> wrote:

> Hi John, I never actually read this example before
> but now I have, thanks.
> 
> I think that first we want to make two things clear.
> 1) What is the purpose of the example?
> To show you how to make more flexible/complex
> definitions of a virtual 
> service (more then just ip and port) using firewall
> marks.
> 
> 2) What do we do following the example?
> We define a whole /24 network
> (192.168.0.0-192.168.0.255 
> (192.168.0.0/24) on any UDP- or TCP-port) as a
> virtual service using a 
> firewall mark.
> 
> With that clear it should be quite obvious that our
> virtual service is 
> not defined for 192.168.6.240 but for the network
> 192.168.0.0/24.
> You have to be able to reach, route to, the
> 192.168.0.0/24 network from 
> the directors (as you say you have configured
> below), and all other 
> clients you wish to test this from
> must some how know about the network to..
> You can verify you routing config using:
> /sbin/ip route list 192.168.0.0/24
> It should give something like:
> 192.168.0.0/24 via 192.168.6.240 dev eth0
> 
> 
> /Mattias
> 

 Thanks Mattias 
    I do get simillar result for 
   ip route list 192.168.0.0/24
   But I am not able to get the web pages of the VIP
from the clients 
         I am trying out different options , if
success I will let the list know about it 
          thanks 
              Joseph John 



> John Joseph skrev:
> > --- Mattias Andersson <[email protected]>
> wrote:
> >
> >   
> >> Please supply the output of the following
> commands
> >>
> >> Your iptables masq settings:
> >> (/sbin/iptables -t nat -L -n)
> >>
> >> and fwmark settings:
> >> (/sbin/iptables -t mangle -L -n)
> >>
> >> and last your ipvsadm config
> >> (ipvsadm -L -n)
> >>
> >> /Mattias
> >>
> >>
> >>     
> >
> > Hi 
> >    Thanks for the mail , my settings are
> >
> > [root@JJ-32-UM-One ~]# iptables -t nat -L -n
> > Chain PREROUTING (policy ACCEPT)
> > target     prot opt source              
> destination
> >
> > Chain POSTROUTING (policy ACCEPT)
> > target     prot opt source              
> destination
> > MASQUERADE  all  --  192.168.7.0/24      
> 0.0.0.0/0
> >
> > Chain OUTPUT (policy ACCEPT)
> > target     prot opt source              
> destination
> > [root@JJ-32-UM-One ~]#
> >
> >
>
*****************************************************
> >
> > [root@JJ-32-UM-One ~]# iptables -t mangle -L -n
> > Chain PREROUTING (policy ACCEPT)
> > target     prot opt source              
> destination
> > MARK       all  --  0.0.0.0/0           
> > 192.168.0.0/24      MARK set 0x1
> >
> > Chain INPUT (policy ACCEPT)
> > target     prot opt source              
> destination
> >
> > Chain FORWARD (policy ACCEPT)
> > target     prot opt source              
> destination
> >
> > Chain OUTPUT (policy ACCEPT)
> > target     prot opt source              
> destination
> >
> > Chain POSTROUTING (policy ACCEPT)
> > target     prot opt source              
> destination
> > [root@JJ-32-UM-One ~]#
> >
> >
>
******************************************************
> >
> > [root@JJ-32-UM-One ~]# ipvsadm -L -n
> > IP Virtual Server version 1.2.0 (size=4096)
> > Prot LocalAddress:Port Scheduler Flags
> >   -> RemoteAddress:Port           Forward Weight
> > ActiveConn InActConn
> > FWM  1 rr
> >   -> 192.168.7.5:0                Masq    1      0
>    
> >      0
> >   -> 192.168.7.4:0                Masq    1      0
>    
> >      0
> >
> >
>
****************************************************************
> >
> > My Gateway Settings 
> > [root@GW-32 ~]# cat /etc/sysconfig/static-routes
> > any net 192.168.0.0 netmask 255.255.255.0 gw
> > 192.168.6.240
> >
> > ******************************
> >                           Thanks 
> >                              Joseph John 
> >
> >
> >
> >
> >   
> >> John Joseph skrev:
> >>     
> >>> --- "Terry, Jason" <[email protected]> wrote:
> >>>
> >>>   
> >>>       
> >>>> You may need to add a line into your
> >>>> /etc/sysconfig/iptables...
> >>>>
> >>>> It's been so long I can't remember the command
> >>>>         
> >> line
> >>     
> >>>> way to add this.
> >>>>
> >>>> However in my iptables file I have an entry
> >>>>         
> >> similar
> >>     
> >>>> to this
> >>>> -A PREROUTING -d 192.168.6.240 -j MARK
> --set-mark
> >>>> 0x1
> >>>>
> >>>>     
> >>>>         
> >>>  
> >>>  I did it [ forget to mention in the last mail],
> >>>       
> >> and
> >>     
> >>> it is not working 
> >>>         I suspect , it is the problem with the
> >>> ldirectord.cf
> >>>            thanks
> >>>                Joseph John 
> >>>
> >>>   
> >>>       
> >>>> -----Original Message-----
> >>>> From: [email protected]
> >>>>
> [mailto:[email protected]]
> >>>>         
> >> On
> >>     
> >>>> Behalf Of John
> >>>> Joseph
> >>>> Sent: Thursday, August 17, 2006 3:51 AM
> >>>> To: UltraMonkey UMMailingList
> >>>> Subject: UM with Firewall -Marking 
> >>>>
> >>>> Hi 
> >>>>     Thanks to the list , I was success in doing
> a
> >>>> test
> >>>> enviornment for  HA-LB 
> >>>> But when I tried to do  Firewall-Marked setup I
> >>>>         
> >> am
> >>     
> >>>> not
> >>>> able to set it up 
> >>>> my   
> >>>> ldirectord.cf contains
> >>>>
> 
=== message truncated ===



		
___________________________________________________________ 
All New Yahoo! Mail – Tired of Vi@gr@! come-ons? Let our SpamGuard protect you. http://uk.docs.yahoo.com/nowyoucan.html


-- 
Ultra Monkey - http://www.ultramonkey.org/
To UNSUBSCRIBE, email to [email protected], with a body:
unsubscribe ultramonkey-users [email protected]
where "[email protected]" is YOUR email address.