Re: Keepalived and NAT loopback,.

Glad to be of help! :-)

On 09/12/2013 05:07 PM, Pat Suwalski wrote:
> Brilliant! It worked!
>
> The key was actually in the net.ipv4.vs.conntrack variable. I haven't
> seen this mentioned in any of the documentation I've been reading
> through over the last month.
>
> And yes, the SNAT rule worked very well.
>
> Thank you so much, Tom.
>
> --Pat
>
> On 13-09-11 05:51 PM, Tom van Leeuwen wrote:
>> Darn: "iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr
>> 200.1.2.3/32 -j MASQUERADE" it should be.
>> After reading your message again, I'm now wondering if you are doing DR.
>>
>> For my convenience a diagram is always very helpful!
>>
>> Kind regards,
>> Tom
>>
>> On 09/11/2013 10:57 PM, Tom van Leeuwen wrote:
>>> So you have 2 VIPS and 4 REALS.
>>> The 4 REALS are in the same subnet 172.16.0.0/24 (assumption cause I
>>> don't see a prefix anywhere).
>>>
>>> You say:
>>>
>>> Looking at tcpdump, it is clear that the 172.16.0.100 and .101 servers
>>> get the request to 200.1.2.3 as originating from 172.16.0.200, and
>>> respond directly from their internal NAT address, making the response
>>> ignored.
>>>
>>> But instead of "their internal NAT address", you mean "their real
>>> internal ip address" I assume.
>>>
>>> So, problem you have is that the traffic goes from "client => lvs =>
>>> server" and the return traffic goes from "server => client". The return
>>> traffic doesn't pass the LVS server and is therefor not NATTED back to
>>> the VIP 200.1.2.3.
>>>
>>> To solve this you need to source nat the traffic on the LVS server:
>>> sysctl net.ipv4.vs.conntrack=1
>>> iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -m ipvs --vaddr
>>> 192.168.200.100/32 -j MASQUERADE
>>>
>>> I'd do "-j SNAT" to the internal VIP (172.16.0.1???) instead of
>>> MASQUERADING to have the same behavior no matter which LVS box is active.
>>>
>>> I hope I understand the issue correctly and that this will help you.
>>>
>>> Kind regards,
>>> Tom
>>>
>>> On 09/11/2013 10:31 PM, Pat Suwalski wrote:
>>>> This seems to be an amazingly difficult problem to solve, and I can't
>>>> for the life of me figure out why it would be so.
>>>>
>>>> --Pat
>>>>
>>>> On 13-08-14 10:38 AM, Pat Suwalski wrote:
>>>>> On 13-08-13 06:51 PM, Paul Robert Marino wrote:
>>>>>> I'm assuming you have 3 public ips with a 1 to 1 two way (Source and
>>>>>> destination) static nat on two of them to two internal hosts with
>>>>>> private IPs
>>>>> This part is correct. It's SNAT/DNAT rules. There are 3 public IPs.
>>>>>
>>>>>> The third public IP is a VIP controlled as a VRRP instance in
>>>>>> keepalived and used by the load ballancer instance ballancing against
>>>>>> the other two public IPs
>>>>>> is this correct?
>>>>> I think it's correct, but I'm not exactly clear on your description.
>>>>> Firewall A has 1 IP, Firewall B has 1 IP, and the failover VIP is 1 IP
>>>>> shared between them.
>>>>>
>>>>> --Pat
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Get 100% visibility into Java/.NET code with AppDynamics Lite!
>>>>> It's a free troubleshooting tool designed for production.
>>>>> Get down to code-level detail for bottlenecks, with <2% overhead.
>>>>> Download for free and get started troubleshooting in minutes.
>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
>>>>> _______________________________________________
>>>>> Keepalived-devel mailing list
>>>>> [email protected]
>>>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>>>>
>>>> ------------------------------------------------------------------------------
>>>> How ServiceNow helps IT people transform IT departments:
>>>> 1. Consolidate legacy IT systems to a single system of record for IT
>>>> 2. Standardize and globalize service processes across IT
>>>> 3. Implement zero-touch automation to replace manual, redundant tasks
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>>>> _______________________________________________
>>>> Keepalived-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>> ------------------------------------------------------------------------------
>>> How ServiceNow helps IT people transform IT departments:
>>> 1. Consolidate legacy IT systems to a single system of record for IT
>>> 2. Standardize and globalize service processes across IT
>>> 3. Implement zero-touch automation to replace manual, redundant tasks
>>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Keepalived-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>
>> ------------------------------------------------------------------------------
>> How ServiceNow helps IT people transform IT departments:
>> 1. Consolidate legacy IT systems to a single system of record for IT
>> 2. Standardize and globalize service processes across IT
>> 3. Implement zero-touch automation to replace manual, redundant tasks
>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Keepalived-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/keepalived-devel
>>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Keepalived-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/keepalived-devel


------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk