Re: Access virtual IP from keepalived host

Dear Paul,

My keepalived configuration is as follows:

bare metal node as keepalived master -> virtual nodes on other host-nodes
as hosts with realIPs.

I use ___iptables -t nat -A PREROUTING -d 192.168.17.11/32 -p tcp -j
REDIRECT___ on virtual nodes with realIP because keepalived doesn't work
without this rule.

I used these rules:
iptables -t rawpost -A POSTROUTING -s 192.168.17.11/32 -p tcp -m tcp
--dport 80 -j RAWSNAT --to-source 192.168.17.134/32
iptables -t rawpost -A POSTROUTING -d 192.168.17.134/32 -p tcp -m tcp
--sport 80 -j RAWSNAT --to-source 192.168.17.11/32
to fix ___192.168.17.11<->192.168.17.11___ issue when I try telnet to VIP
from keepalived master host.

Flushing the iptables completely doesn't solve the issue.


2013/7/17 Paul Robert Marino <[email protected]>

> seriously what you are doing with iptables here is like seeing hoof
> print on on the ground in north American and looking for a zebras. Its
> nothing that exotic its not even a routing issue at this point because
> the kernel is trying to talk to an IP address it owns so unless you
> are using network namespaces for some reason routing doesn't even come
> into it.
>
>
> try flushing iptables completely and makeing sure your host.allow and
> host.deny files are empty.
> Run through the basics because it sounds like you missed something
> simple on the OS or the application in question.
>
>
>
> On Wed, Jul 17, 2013 at 3:55 AM, kay <[email protected]> wrote:
> > I have added iptables raw rules.
> >
> > 192.168.17.134:
> > iptables -t rawpost -A POSTROUTING -s 192.168.17.11/32 -p tcp -m tcp
> --dport
> > 80 -j RAWSNAT --to-source 192.168.17.134/32
> >
> > 192.168.17.12, 192.168.17.13:
> > iptables -t rawpost -A POSTROUTING -d 192.168.17.134/32 -p tcp -m tcp
> > --sport 80 -j RAWSNAT --to-source 192.168.17.11/32
> > iptables -t nat -A PREROUTING -d 192.168.17.11/32 -p tcp -j REDIRECT
> >
> > And got rather good (syn packets goes well but not rest) tcpdump for
> telnet.
> > But unfortunately connection still could not be established. Here is the
> > latest tcpdump from keepalived master:
> >
> > 192.168.17.12
> > 10:51:54.079823 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S],
> seq
> > 288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
> > 0,nop,wscale 8], length 0
> > 10:51:54.079877 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.],
> seq
> > 1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
> > 53357747 ecr 248832331,nop,wscale 6], length 0
> >
> >
> > 192.168.17.134
> > 10:51:54.093857 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S],
> seq
> > 288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
> > 0,nop,wscale 8], length 0
> > 10:51:54.093873 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S],
> seq
> > 288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
> > 0,nop,wscale 8], length 0
> > 10:51:54.093876 IP 192.168.17.134.20947 > 192.168.17.11.80: Flags [S],
> seq
> > 288135450, win 32792, options [mss 16396,sackOK,TS val 248832331 ecr
> > 0,nop,wscale 8], length 0
> > 10:51:54.094153 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.],
> seq
> > 1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
> > 53357747 ecr 248832331,nop,wscale 6], length 0
> > 10:51:54.094153 IP 192.168.17.11.80 > 192.168.17.134.20947: Flags [S.],
> seq
> > 1864997865, ack 288135451, win 14480, options [mss 1460,sackOK,TS val
> > 53357747 ecr 248832331,nop,wscale 6], length 0
> >
> > I can not understand why only SYN packets goes well. What about rest
> > packets?
> >
> >
> > 2013/7/17 kay <[email protected]>
> >>
> >> Yes, I am sure.
> >>
> >> Here is my configuration:
> >>
> >> Real IP is 192.168.17.134
> >>
> >> ipvsadm -Ln
> >> IP Virtual Server version 1.2.1 (size=4096)
> >> Prot LocalAddress:Port Scheduler Flags
> >> -> RemoteAddress:Port Forward Weight ActiveConn InActConn
> >> TCP 192.168.17.11:80 rr
> >> -> 192.168.17.12:80 Route 1 0 0
> >> -> 192.168.17.13:80 Route 1 0 0
> >>
> >> Here is telnet tcpdump log on the keepalived host:
> >>
> >> 10:15:34.678609 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> >> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> >> 0,nop,wscale 8], length 0
> >> 10:15:34.678624 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> >> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> >> 0,nop,wscale 8], length 0
> >> 10:15:34.678627 IP 192.168.17.11.8785 > 192.168.17.11.80: Flags [S], seq
> >> 797301908, win 32792, options [mss 16396,sackOK,TS val 246652916 ecr
> >> 0,nop,wscale 8], length 0
> >>
> >> And it is not possible to add route rule to table:
> >>
> >> ip route add table local 192.168.17.11/32 dev eth0 proto kernel scope
> link
> >> src 192.168.17.134
> >> RTNETLINK answers: File exists
> >>
> >>
> >> 2013/7/17 Paul Robert Marino <[email protected]>
> >>>
> >>> That should never be a problem it should hit your network stack and
> loop
> >>> back before it even goes across your physical network. Are you sure you
> >>> application doesn't have some sort of ACL on the source address
> blocking it.
> >>>
> >>>
> >>>
> >>>
> >>> -- Sent from my HP Pre3
> >>>
> >>> ________________________________
> >>> On Jul 16, 2013 15:17, kay <[email protected]> wrote:
> >>>
> >>> For some reason it doesn't work. I guess that is because eth0 has
> several
> >>> IP addresses. And when I access VIP the source IP is VIP. How can I
> make
> >>> source IP to be real IP? Maybe I need to use iproute2 with ip rules?
> >>>
> >>>
> >>> 2013/7/16 Paul Robert Marino <[email protected]>
> >>>>
> >>>> Yea that shouldn't ever be a problem.
> >>>>
> >>>>
> >>>>
> >>>> -- Sent from my HP Pre3
> >>>>
> >>>> ________________________________
> >>>> On Jul 16, 2013 10:32, kay <[email protected]> wrote:
> >>>>
> >>>> Hello,
> >>>>
> >>>> Is it possible to access local VIP from keepalived host? I can access
> it
> >>>> from remote host but I need to access it from local keepalived host
> too.
> >>>
> >>>
> >>
> >
> >
> >
> ------------------------------------------------------------------------------
> > See everything from the browser to the database with AppDynamics
> > Get end-to-end visibility with application monitoring from AppDynamics
> > Isolate bottlenecks and diagnose root cause in seconds.
> > Start your free trial of AppDynamics Pro today!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Keepalived-devel mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/keepalived-devel
> >
>

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel