Re: Keepalived and NAT loopback,.

Brilliant! It worked!

The key was actually in the net.ipv4.vs.conntrack variable. I haven't 
seen this mentioned in any of the documentation I've been reading 
through over the last month.

And yes, the SNAT rule worked very well.

Thank you so much, Tom.

--Pat

On 13-09-11 05:51 PM, Tom van Leeuwen wrote:
> Darn: "iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr
> 200.1.2.3/32 -j MASQUERADE" it should be.
> After reading your message again, I'm now wondering if you are doing DR.
>
> For my convenience a diagram is always very helpful!
>
> Kind regards,
> Tom
>
> On 09/11/2013 10:57 PM, Tom van Leeuwen wrote:
>> So you have 2 VIPS and 4 REALS.
>> The 4 REALS are in the same subnet 172.16.0.0/24 (assumption cause I
>> don't see a prefix anywhere).
>>
>> You say:
>>
>> Looking at tcpdump, it is clear that the 172.16.0.100 and .101 servers
>> get the request to 200.1.2.3 as originating from 172.16.0.200, and
>> respond directly from their internal NAT address, making the response
>> ignored.
>>
>> But instead of "their internal NAT address", you mean "their real
>> internal ip address" I assume.
>>
>> So, problem you have is that the traffic goes from "client => lvs =>
>> server" and the return traffic goes from "server => client". The return
>> traffic doesn't pass the LVS server and is therefor not NATTED back to
>> the VIP 200.1.2.3.
>>
>> To solve this you need to source nat the traffic on the LVS server:
>> sysctl net.ipv4.vs.conntrack=1
>> iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr
>> 192.168.200.100/32 -j MASQUERADE
>>
>> I'd do "-j SNAT" to the internal VIP (172.16.0.1???) instead of
>> MASQUERADING to have the same behavior no matter which LVS box is active.
>>
>> I hope I understand the issue correctly and that this will help you.
>>
>> Kind regards,
>> Tom
>>
>> On 09/11/2013 10:31 PM, Pat Suwalski wrote:
>>> This seems to be an amazingly difficult problem to solve, and I can't
>>> for the life of me figure out why it would be so.
>>>
>>> --Pat
>>>
>>> On 13-08-14 10:38 AM, Pat Suwalski wrote:
>>>> On 13-08-13 06:51 PM, Paul Robert Marino wrote:
>>>>> I'm assuming you have 3 public ips with a 1 to 1 two way (Source and
>>>>> destination) static nat on two of them to two internal hosts with
>>>>> private IPs
>>>> This part is correct. It's SNAT/DNAT rules. There are 3 public IPs.
>>>>
>>>>> The third public IP is a VIP controlled as a VRRP instance in
>>>>> keepalived and used by the load ballancer instance ballancing against
>>>>> the other two public IPs
>>>>> is this correct?
>>>> I think it's correct, but I'm not exactly clear on your description.
>>>> Firewall A has 1 IP, Firewall B has 1 IP, and the failover VIP is 1 IP
>>>> shared between them.
>>>>
>>>> --Pat
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Get 100% visibility into Java/.NET code with AppDynamics Lite!
>>>> It's a free troubleshooting tool designed for production.
>>>> Get down to code-level detail for bottlenecks, with <2% overhead.
>>>> Download for free and get started troubleshooting in minutes.
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
>>>> _______________________________________________
>>>> Keepalived-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>>>
>>> ------------------------------------------------------------------------------
>>> How ServiceNow helps IT people transform IT departments:
>>> 1. Consolidate legacy IT systems to a single system of record for IT
>>> 2. Standardize and globalize service processes across IT
>>> 3. Implement zero-touch automation to replace manual, redundant tasks
>>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Keepalived-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>
>> ------------------------------------------------------------------------------
>> How ServiceNow helps IT people transform IT departments:
>> 1. Consolidate legacy IT systems to a single system of record for IT
>> 2. Standardize and globalize service processes across IT
>> 3. Implement zero-touch automation to replace manual, redundant tasks
>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Keepalived-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Keepalived-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>


------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk