Re: Keepalived and NAT loopback,.

So you have 2 VIPS and 4 REALS.
The 4 REALS are in the same subnet 172.16.0.0/24 (assumption cause I 
don't see a prefix anywhere).

You say:

Looking at tcpdump, it is clear that the 172.16.0.100 and .101 servers
get the request to 200.1.2.3 as originating from 172.16.0.200, and
respond directly from their internal NAT address, making the response
ignored.

But instead of "their internal NAT address", you mean "their real 
internal ip address" I assume.

So, problem you have is that the traffic goes from "client => lvs => 
server" and the return traffic goes from "server => client". The return 
traffic doesn't pass the LVS server and is therefor not NATTED back to 
the VIP 200.1.2.3.

To solve this you need to source nat the traffic on the LVS server:
sysctl net.ipv4.vs.conntrack=1
iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr 
192.168.200.100/32 -j MASQUERADE

I'd do "-j SNAT" to the internal VIP (172.16.0.1???) instead of 
MASQUERADING to have the same behavior no matter which LVS box is active.

I hope I understand the issue correctly and that this will help you.

Kind regards,
Tom

On 09/11/2013 10:31 PM, Pat Suwalski wrote:
> This seems to be an amazingly difficult problem to solve, and I can't
> for the life of me figure out why it would be so.
>
> --Pat
>
> On 13-08-14 10:38 AM, Pat Suwalski wrote:
>> On 13-08-13 06:51 PM, Paul Robert Marino wrote:
>>> I'm assuming you have 3 public ips with a 1 to 1 two way (Source and
>>> destination) static nat on two of them to two internal hosts with
>>> private IPs
>> This part is correct. It's SNAT/DNAT rules. There are 3 public IPs.
>>
>>> The third public IP is a VIP controlled as a VRRP instance in
>>> keepalived and used by the load ballancer instance ballancing against
>>> the other two public IPs
>>> is this correct?
>> I think it's correct, but I'm not exactly clear on your description.
>> Firewall A has 1 IP, Firewall B has 1 IP, and the failover VIP is 1 IP
>> shared between them.
>>
>> --Pat
>>
>>
>> ------------------------------------------------------------------------------
>> Get 100% visibility into Java/.NET code with AppDynamics Lite!
>> It's a free troubleshooting tool designed for production.
>> Get down to code-level detail for bottlenecks, with <2% overhead.
>> Download for free and get started troubleshooting in minutes.
>> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Keepalived-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Keepalived-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/keepalived-devel


------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk