Re: SNAT Confusion

To: Rodre Ghorashi-Zadeh <rodrico7@xxxxxxxxxxx>
Subject: Re: SNAT Confusion
Cc: lvs-users@xxxxxxxxxxxxxxxxxxxxxx
From: Janusz Krzysztofik <jkrzyszt@xxxxxxxxxxxx>
Date: Mon, 19 Mar 2007 14:06:33 +0100
Rodre Ghorashi-Zadeh napisał(a):
I can see the traffic being SNAT-ed and hitting the realserver and being sent back but then packet trail just seemed to drop off. I figure it is because the kernel on the director is probably looking at the source address of the reply packet, which matches the VIP ip that is on the director, and is saying "hey, I didn't send this!" and is dropping the packet. What am I not seeing here? What am I missing? What I guess I need here is the so called f5 style SNAT? How can I achieve what I need to do?


Sorry, I have read the thread in reverse direction and have missed this important point while sending my previous reply. You are right, the problem is probably related to source address matching VIP configured on the director. I can think of three possible solutions:

1. Try to find and apply an IPVS-related patch that allows a director to accept packets with source address matching one of its own addresses (I have no experience with this patch).

2. Remove VIP from your director and use static routing / proxy arp and netfilter marking instead (this is my way of doing things). If you do need VIP on your director for other clients to work, use an additional VIP configured this way for accessing your realservers just from themselves via LVS.

3. Do SNAT on your realservers when acting as LVS clients, not on the director (I had this working some time ago, but removed this config as I do not need it anymore).


<Prev in Thread] Current Thread [Next in Thread>