Re: Keepalived and NAT loopback,.

I guess there are no ideas about this?

Thanks,
--Pat

On 13-08-05 12:04 AM, Pat Suwalski wrote:
> Thanks for that background.
>
> I have two sets of services that need load balancing and failover. We'll
> say the first is on addresses 172.16.0.100 and 172.16.0.101, and is
> visible on the internet as 200.1.2.3. The second is made up of
> 172.16.0.200 and 172.16.0.201, on the internet as 200.1.2.10.
>
> The services running on the second service, 200.1.2.10, need to make
> HTTP API calls to the 200.1.2.3. It needs to be to the virtual IP, for
> load balancing and failover purposes.
>
> Looking at tcpdump, it is clear that the 172.16.0.100 and .101 servers
> get the request to 200.1.2.3 as originating from 172.16.0.200, and
> respond directly from their internal NAT address, making the response
> ignored.
>
> The only solution I could possibly think of is to create another
> (duplicate) stanza in the keepalived.conf file for 172.16.0.100/101, but
> with an internal 172.16.0.x virtual IP. But I'd really rather not have
> the duplication and second set of HTTP_GET checks.
>
> I'm sure there is a better solution to this problem. Maybe something as
> simple as assigning a second (alias) virtual IP somehow, inside the
> firewall.
>
> Thanks for reading,
> --Pat
>
> On 13-08-04 06:58 PM, Paul Robert Marino wrote:
>> Nat on a loopback is was deprecated (since kernel version 2.4) then
>> disabled netfilters (in kernel version 2.6) along time ago and selinux
>> blocks it too. The reason is its a potential massive security hole.
>> You can do it via the dummy Ethernet driver which provides this kind of
>> functionality however there are better way to do this.
>>
>> Please describe exactly what you are trying to do and well try to help
>> you.
>>
>>
>>
>>
>> -- Sent from my HP Pre3
>>
>> ------------------------------------------------------------------------
>> On Aug 1, 2013 15:24, Pat Suwalski <[email protected]> wrote:
>>
>> Hello.
>>
>> (Apologies if this isn't the right place, I notice there is no -users
>> list).
>>
>> I have a configuration using keepalived for Apache, set up pretty much
>> exactly as described here:
>>
>> http://keepalived.org/LVS-NAT-Keepalived-HOWTO.html
>>
>> Now, I have a third internal server that is using the virtual internal
>> IP as its gateway. I need this server to be able to access loadbalanced
>> content. So, if the outside virtual address of keepalived is 1.2.3.4,
>> that is what server three needs to get at.
>>
>> I can't seem to find a way to make this work. Using a "standard"
>> loopback recipe with iptables, such as this one:
>>
>> http://for-invent.com/nat-loopback-using-iptables/
>>
>> is not doable, because the --to-destination is one of the two
>> loadbalanced web servers.
>>
>> Has anyone managed to solve this?
>>
>> Many thanks,
>> --Pat
>>
>> ------------------------------------------------------------------------------
>>
>>
>> Get your SQL database under version control now!
>> Version control is standard for application code, but databases havent
>> caught up. So what steps can you take to put your SQL databases under
>> version control? Why should you start doing it? Read more to find out.
>> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
>>
>> _______________________________________________
>> Keepalived-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel


------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead. 
Download for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk