Re: Keepalived and NAT loopback,.

Darn: "iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr 
200.1.2.3/32 -j MASQUERADE" it should be.
After reading your message again, I'm now wondering if you are doing DR.

For my convenience a diagram is always very helpful!

Kind regards,
Tom

On 09/11/2013 10:57 PM, Tom van Leeuwen wrote:
> So you have 2 VIPS and 4 REALS.
> The 4 REALS are in the same subnet 172.16.0.0/24 (assumption cause I
> don't see a prefix anywhere).
>
> You say:
>
> Looking at tcpdump, it is clear that the 172.16.0.100 and .101 servers
> get the request to 200.1.2.3 as originating from 172.16.0.200, and
> respond directly from their internal NAT address, making the response
> ignored.
>
> But instead of "their internal NAT address", you mean "their real
> internal ip address" I assume.
>
> So, problem you have is that the traffic goes from "client => lvs =>
> server" and the return traffic goes from "server => client". The return
> traffic doesn't pass the LVS server and is therefor not NATTED back to
> the VIP 200.1.2.3.
>
> To solve this you need to source nat the traffic on the LVS server:
> sysctl net.ipv4.vs.conntrack=1
> iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr
> 192.168.200.100/32 -j MASQUERADE
>
> I'd do "-j SNAT" to the internal VIP (172.16.0.1???) instead of
> MASQUERADING to have the same behavior no matter which LVS box is active.
>
> I hope I understand the issue correctly and that this will help you.
>
> Kind regards,
> Tom
>
> On 09/11/2013 10:31 PM, Pat Suwalski wrote:
>> This seems to be an amazingly difficult problem to solve, and I can't
>> for the life of me figure out why it would be so.
>>
>> --Pat
>>
>> On 13-08-14 10:38 AM, Pat Suwalski wrote:
>>> On 13-08-13 06:51 PM, Paul Robert Marino wrote:
>>>> I'm assuming you have 3 public ips with a 1 to 1 two way (Source and
>>>> destination) static nat on two of them to two internal hosts with
>>>> private IPs
>>> This part is correct. It's SNAT/DNAT rules. There are 3 public IPs.
>>>
>>>> The third public IP is a VIP controlled as a VRRP instance in
>>>> keepalived and used by the load ballancer instance ballancing against
>>>> the other two public IPs
>>>> is this correct?
>>> I think it's correct, but I'm not exactly clear on your description.
>>> Firewall A has 1 IP, Firewall B has 1 IP, and the failover VIP is 1 IP
>>> shared between them.
>>>
>>> --Pat
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Get 100% visibility into Java/.NET code with AppDynamics Lite!
>>> It's a free troubleshooting tool designed for production.
>>> Get down to code-level detail for bottlenecks, with <2% overhead.
>>> Download for free and get started troubleshooting in minutes.
>>> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Keepalived-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>>
>> ------------------------------------------------------------------------------
>> How ServiceNow helps IT people transform IT departments:
>> 1. Consolidate legacy IT systems to a single system of record for IT
>> 2. Standardize and globalize service processes across IT
>> 3. Implement zero-touch automation to replace manual, redundant tasks
>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Keepalived-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Keepalived-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/keepalived-devel


------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk