|
On Tue, 15 Apr 2008, Jason Stubbs wrote:
I'm a newbie at all of this so forgive me if I'm doing anything wrong. ;)
you're doing great.
incoming => de-lvs packets => netfilter => lvs packets => outgoing
The goal is for netfilter to only have to deal with CIP/VIP packets and
for any translations netfilter might do of CIP to be transparent to LVS.
can you give me an example of a translation of the CIP (I
can't think of anything, presumably the F5-SNAT will be done
in outgoing).
There are three main downfalls with this patch at present:
1) Having a VIP on a local interface
I thought with the hooks in the new place that there'd be no
VIP on the director anymore. The director would be acting as
a router for dst_addr=VIP. Presumbly routing would handle
sending packets for the VIP to the director (eg the director
would proxy arp for the VIP).
Are you talking about a case where the director is
misconfigured?
causes the traffic to be delivered
locally as VIP checks have been moved to the end of POST_ROUTING.
2) Localnode with address of 127.0.0.1 does not work as packets with a
destination of 127.0.0.1 and a non-local source address are
unconditionally dropped.
3) Firewall rules on existing installations will most likely break.
no problem. This is a new setup and will have new rules.
The first issue can probably be dealt with by The
localnode issue could probably be dealt with by using a
hook at the end of PREROUTING and the second issue could
be handled like ipt_REDIRECT.
I thought with netfilter, that REDIRECT delivers a packet
that now has the wrong address for LVS.
I can't see a way to handle firewall rules though
you haven't figured it out yet, or you've looked and there
is no way of having firewall rules?
Joe
--
Joseph Mack NA3T EME(B,D), FM05lw North Carolina
jmack (at) wm7d (dot) net - azimuthal equidistant map
generator at http://www.wm7d.net/azproj.shtml
Homepage http://www.austintek.com/ It's GNU/Linux!
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
| 