NAT question

Good afternoon, all.  I've been reading through the documentation for 
setting up an LVS environment, both with the piranha interface to the 
lvs.cf file and also on the LVS site.  Both sites are leaving me 
hanging.

First off, I'm using RHAS2.1 and am trying to provide high availability 
and load balancing for an Oracle Collaboration Suite installation.  It 
looks like, including the two LVS systems (if I can ever get them 
working) I'll have eight machines total:  two DB, two Infrastructure 
(active/passive failover with RHCM), two mid-tier (active/active for 
smtp, http, ftp, smb, imap, pop, etc. and active/passive for the Oracle 
Calendar component) and two LVS directors in an active/passive 
configuration.  I would really rather use LVS-DR, but that's not a 
supported configuration in RHAS and I can't get around the "arp 
problem" without resorting to patching the kernel myself (which I 
really don't want to do, again for support reasons).

The documentation on the RH site seems to assume that you're starting 
with a fresh install of RHAS on the director and real-server, and walks 
you through configuration of LVS once the cables are run.  I've 
successfully configured my director to send SSH traffic to a single 
real-server, but the problem I'm having is that the real-server cannot 
contact the outside network.  Let's take the basic LVS-NAT layout:


                         ________
                        |        |
                        | client | (local or on internet)
                        |________|  192.168.25.23
                            |
                         (router)
                            |
--                         |
L                      Virtual IP (192.168.25.213)
i                      ____|_____
n                     |          | (director can have 1 or 2 NICs)
u                     | director | 192.168.25.91
x                     |__________|
                            | 10.1.99.10 (virtual) / 10.1.99.1 (fixed)
V                          |
i                          |
r         ----------------------------------
t         |                |               |
u         |                |               |
a         |                |               |
l    _____________   _____________   _____________
     |             | |             | |             |
S   | realserver1 | | realserver2 | | realserver3 |
e   |_____________| |_____________| |_____________|
r     (10.1.98.1)     (10.1.98.2)     (10.1.98.3)
v
e
r
---

The IP address of a single client is 192.168.25.23.  The virtual IP of 
the director is 192.168.25.213 (which can be taken over by a not-shown 
second director for failover purposes).  The "real" IP of the director 
is 192.168.25.91 (this IP is assigned to the machine and does not 
move).  This network is 192.268.25.0/24.

Now, on the "internal" network, 10.1.99.10 is the virtual IP of the 
director (again held by the active director in a two-director 
configuration), 10.1.99.1 is the "real" IP of the director in the 
internal network, and 10.1.98.1, ..., .3 are the IPs of the real 
servers.

At this point, I can establish, for example, an SSH connection to the 
virtual IP 192.168.25.213 and have it directed to realserver1, but 
realserver1 cannot get anywhere else on the network.  It seems to me 
that I need to configure the director to masquerade traffic from the 
real-servers to the rest of the network without impacting the LVS 
component of the director.  This is not covered anywhere in the 
documentation, however!  Is it as simple as configuring vanilla IP 
masquerading on the director completely separate from LVS?  I would 
guess not since there seems to be iptables configuration necessary to 
handle firewall marks.

Did I miss a section of the documentation somewhere, or is that all 
left as an exercise for the reader?  HELP!

Thanks,
B


-- 
Brian Lalor
Web Portal Analyst
Delta Faucet Co.
[email protected]
(v) 317-573-3461