Re: Access virtual IP from keepalived host

I have added iptables raw rules.

192.168.17.134:
iptables -t rawpost -A POSTROUTING -s 192.168.17.11/32 -p tcp -m tcp
--dport 80 -j RAWSNAT --to-source 192.168.17.134/32

192.168.17.12, 192.168.17.13:
iptables -t rawpost -A POSTROUTING -d 192.168.17.134/32 -p tcp -m tcp
--sport 80 -j RAWSNAT --to-source 192.168.17.11/32
iptables -t nat -A PREROUTING -d 192.168.17.11/32 -p tcp -j REDIRECT

And got rather good (syn packets goes well but not rest) tcpdump for
telnet. But unfortunately connection still could not be established. Here
is the latest tcpdump from keepalived master:

192.168.17.12
10:51:54.079823 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S], seq
288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
0,nop,wscale 8], length 0
10:51:54.079877 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.], seq
1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
53357747 ecr 248832331,nop,wscale 6], length 0


192.168.17.134
10:51:54.093857 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S], seq
288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
0,nop,wscale 8], length 0
10:51:54.093873 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S], seq
288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
0,nop,wscale 8], length 0
10:51:54.093876 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S], seq
288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
0,nop,wscale 8], length 0
10:51:54.094153 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.], seq
1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
53357747 ecr 248832331,nop,wscale 6], length 0
10:51:54.094153 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.], seq
1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
53357747 ecr 248832331,nop,wscale 6], length 0

I can not understand why only SYN packets goes well. What about rest
packets?


2013/7/17 kay <[email protected]>

> Yes, I am sure.
>
> Here is my configuration:
>
> Real IP is 192.168.17.134
>
> ipvsadm -Ln
> IP Virtual Server version 1.2.1 (size=4096)
> Prot LocalAddress:Port Scheduler Flags
> -> RemoteAddress:Port Forward Weight ActiveConn InActConn
> TCP 192.168.17.11:80 rr
> -> 192.168.17.12:80 Route 1 0 0
> -> 192.168.17.13:80 Route 1 0 0
>
> Here is telnet tcpdump log on the keepalived host:
>
> 10:15:34.678609 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> 0,nop,wscale 8], length 0
> 10:15:34.678624 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> 0,nop,wscale 8], length 0
> 10:15:34.678627 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> 0,nop,wscale 8], length 0
>
> And it is not possible to add route rule to table:
>
> ip route add table local 192.168.17.11/32 dev eth0 proto kernel scope
> link src 192.168.17.134
> RTNETLINK answers: File exists
>
>
> 2013/7/17 Paul Robert Marino <[email protected]>
>
>> That should never be a problem it should hit your network stack and loop
>> back before it even goes across your physical network. Are you sure you
>> application doesn't have some sort of ACL on the source address blocking it.
>>
>>
>>
>>
>> -- Sent from my HP Pre3
>>
>> ------------------------------
>> On Jul 16, 2013 15:17, kay <[email protected]> wrote:
>>
>> For some reason it doesn't work. I guess that is because eth0 has several
>> IP addresses. And when I access VIP the source IP is VIP. How can I make
>> source IP to be real IP? Maybe I need to use iproute2 with ip rules?
>>
>>
>> 2013/7/16 Paul Robert Marino <[email protected]>
>>
>>> Yea that shouldn't ever be a problem.
>>>
>>>
>>>
>>> -- Sent from my HP Pre3
>>>
>>> ------------------------------
>>> On Jul 16, 2013 10:32, kay <[email protected]> wrote:
>>>
>>> Hello,
>>>
>>> Is it possible to access local VIP from keepalived host? I can access it
>>> from remote host but I need to access it from local keepalived host too.
>>>
>>
>>
>

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel