problem making my director the point of entry (firewall)

Hello list,

I've got a bit of a problem I hope you can help with.  My basic 
configuration is similar to the high capacity configuration example:


http://www.ultramonkey.org/3/topologies/hc-ha-lb-eg.html


the difference is that every server in the network has two network 
interface cards with a public IP on eth0 and a private switch 
(192.168.3.0/24) connected to eth1 on each machine.

The ldirector and heartbeat configuration is working fine, *if* I hit 
the virtual IP from another machine on the 192.168.3.0/24 switch.

To be specific, my primary loadbalancer is 192.168.3.101.  real servers 
are 192.168.3.201 and 192.168.3.202, virtual IP is 192.168.3.200.

We have a machine unrelated to the LVS setup other than the fact that 
its also connected to the private switch on 192.168.3.250.  If I request 
a load balanced service from that machine it works perfect, eg from the 
command line:

lynx http://192.168.3.200/ loads perfectly, and IPVSADM -L on the load 
balancer shows the connection etc.

BUT, if I try that same command from the load balancer, it fails.  And 
for the same reason (I think), if I try to setup iptables forwarding 
code on the load balancer to take connections from the public IP and 
route them to the virtual IP it will not work.

TCP dump doesn't show me any chatter directed to the virtual ip when I 
try the same lynx command from the load balancer but of course does show 
it when I try from the unrelated web server.

What am I doing wrong here?  Machines are all centos5.2 with all the 
ipvs modules loaded as per the instructions.  FWIW, the other 
configurations did not work for me (NAT and FWMARK) but the high 
capacity setup does work, just not from the director.  I've tried with 
and without a firewall on all the machines to rule that out as a 
possibility.

Any help would be much appreciated, thanks for your time!

-- 
-----------------------------
Marc Swanson
M Swanson Consulting LLC

Email:  [email protected]
Phone:  (603)413-6833
Cell:   (603)512-1267
Fax:    (603)316-0372

http://www.mswanson.com
_______________________________________________
Ultramonkey-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/ultramonkey-users