|
On Mon, Oct 06, 2003 at 05:39:33AM -0400, Joseph Mack wrote:
> Horms wrote:
> >
>
> > TPROXY looks like it would work because it is completely different
> > from REDIRECT and uses its own connection tracking.
>
> can you explain some more? I don't know the difference
I am not sure how to explain this any more clearly.
REDIRECT uses netfilter's internal connection tracking routines.
Because of the way that LVS is implemted these do not work for
packets that are handled by LVS. Thus the connection tracking
for REDIRECT does not work. Thus the return packets from the
real servers are not modified and the connection fails.
>From my reading TPROXY uses its own connection tracking routines
(though for what reason I am not sure). These routines probably
aren't effected by LVS and thus TPROXY should work.
N.B: I have not verified this.
--
Horms
|
