LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: Persistence through a firewall

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: Persistence through a firewall
From: Roberto Nibali <ratz@xxxxxxxxxxxx>
Date: Tue, 10 Aug 2004 23:33:06 +0200
Hi,

I have an LVS director that uses wrr with 3600 of

LVS_DR, LVS_NAT or LVS_TUN? What kernel version?

persistence for two real servers. I noticed that
connections going through a firewall from my internal
network tend to get locked into one of my real servers
but usually doesn't go to the other real server unless
all of the connections have expired to the first real server.

Correct.

From what I understood with LVS is it's support to use
the source IP for persistence but I wasn't sure if it
also used a source port.

No, it doesn't. The persistent template is created as follows:

<{proto,} caddr, 0, vaddr, vport, daddr, dport>

As you can see, the cport is set to 0 globally.

Would using a different scheduler or a kernel upgrade
(with a new lvs version) work around this?

No, you need to tweak ../net/ipv4/ipvs/ip_vs_core.c:ip_vs_sched_persist().

I'm using ipvsadm v1.21 2002/11/12 (compiled with popt
and IPVS v1.0.9).

It's of no relevance to this problem of yours.

Best regards,
Roberto Nibali, ratz
--
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc
<Prev in Thread] Current Thread [Next in Thread>