Re: problem making my director the point of entry (firewall)

On Mon, Dec 29, 2008 at 12:44:07PM -0500, Marc Swanson wrote:
> Hello list,
> 
> I've got a bit of a problem I hope you can help with.  My basic 
> configuration is similar to the high capacity configuration example:
> 
> 
> http://www.ultramonkey.org/3/topologies/hc-ha-lb-eg.html
> 
> 
> the difference is that every server in the network has two network 
> interface cards with a public IP on eth0 and a private switch 
> (192.168.3.0/24) connected to eth1 on each machine.
> 
> The ldirector and heartbeat configuration is working fine, *if* I hit 
> the virtual IP from another machine on the 192.168.3.0/24 switch.
> 
> To be specific, my primary loadbalancer is 192.168.3.101.  real servers 
> are 192.168.3.201 and 192.168.3.202, virtual IP is 192.168.3.200.
> 
> We have a machine unrelated to the LVS setup other than the fact that 
> its also connected to the private switch on 192.168.3.250.  If I request 
> a load balanced service from that machine it works perfect, eg from the 
> command line:
> 
> lynx http://192.168.3.200/ loads perfectly, and IPVSADM -L on the load 
> balancer shows the connection etc.
> 
> BUT, if I try that same command from the load balancer, it fails.  And 
> for the same reason (I think), if I try to setup iptables forwarding 
> code on the load balancer to take connections from the public IP and 
> route them to the virtual IP it will not work.

Up until the 2.6.28 kernel (which was released very recently), LVS was
not able to load balance connections that originate from the
linux-director. So this probably isn't related to why connections
from public IP addresses aren't working.

> TCP dump doesn't show me any chatter directed to the virtual ip when I 
> try the same lynx command from the load balancer but of course does show 
> it when I try from the unrelated web server.
> 
> What am I doing wrong here?  Machines are all centos5.2 with all the 
> ipvs modules loaded as per the instructions.  FWIW, the other 
> configurations did not work for me (NAT and FWMARK) but the high 
> capacity setup does work, just not from the director.  I've tried with 
> and without a firewall on all the machines to rule that out as a 
> possibility.
> 
> Any help would be much appreciated, thanks for your time!

That is very curious.

The first think I would do is to check that there aren't any iptables
rules on the linux director that might be getting in the way.

The next thing that I would check is that the ARP problem has been handled
- that is, the real server's won't answer ARP requests for the VIP. It
doesn't sound like this is your problem. But its a common trap to fall
into.

Keep in mind that the VIP should be present on the linux director and
conceptually (at the nefilter level anyway) end-uers are making a
connection to the VIP on the linux director. If you are using LVS-DR
(which you are) then it forwards the packets onto the chosen real-server.
The packets will look the same, just the destination MAC address will have
changed. The real-server, which also typically needs to have the VIP
present, then receives the packet as if it was sent to it in the first
place. And will reply directly to the real-server - by which I mean
the reply won't go back through the linux director, but of corse it
may pass through a router in order to get to another network.

Armed with that knowledge, I would poke around with tcpdump.
The -e option is useful here. The path for packets should be
something like this:


[end-user] ----> [ gw ] ----> [linux-director] ----> [ real-server ]
[        ] <---- [    ] <--------------------------- [             ]



> -- ----------------------------- Marc Swanson M Swanson Consulting LLC
> 
> Email:  [email protected] Phone:  (603)413-6833 Cell:   (603)512-1267
> Fax:    (603)316-0372
> 
> http://www.mswanson.com _______________________________________________
> Ultramonkey-users mailing list [email protected]
> http://lists.vergenet.net/listinfo/ultramonkey-users

-- 
Simon Horman
  VA Linux Systems Japan K.K., Sydney, Australia Satellite Office
  H: www.vergenet.net/~horms/             W: www.valinux.co.jp/en

_______________________________________________
Ultramonkey-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/ultramonkey-users