Re: [PATCH v2 0/4] IPVS full NAT support + netfilter 'ipvs' match suppo

To: Hannes Eder <heder@xxxxxxxxxx>, lvs-devel@xxxxxxxxxxxxxxx, Wensong Zhang <wensong@xxxxxxxxxxxx>, Julius Volz <julius.volz@xxxxxxxxx>, lvs-users@xxxxxxxxxxxxxxxxxxxxxx, Laurent Grawet <laurent.grawet@xxxxxxxxxxxx>, Jean-Luc Fortemaison <jl.fortemaison@xxxxxxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx, Jan Engelhardt <jengelh@xxxxxxxxxx>, Julian Anastasov <ja@xxxxxx>, netfilter-devel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxxxxxx, Fabien Duchêne <mad_fab@xxxxxxxxx>, Joseph Mack NA3T <jmack@xxxxxxxx>, Patrick McHardy <kaber@xxxxxxxxx>
Subject: Re: [PATCH v2 0/4] IPVS full NAT support + netfilter 'ipvs' match support
From: Hannes Eder <heder@xxxxxxxxxx>
Date: Tue, 29 Sep 2009 17:07:24 +0200
On Tue, Sep 29, 2009 at 16:51, Simon Horman <horms@xxxxxxxxxxxx> wrote:
> On Tue, Sep 29, 2009 at 02:35:15PM +0200, Hannes Eder wrote:
>> The following series implements full NAT support for IPVS.  The
>> approach is via a minimal change to IPVS (make friends with
>> nf_conntrack) and adding a netfilter matcher, kernel- and user-space
>> part, i.e. xt_ipvs and libxt_ipvs.
> Its a bit late in the day for me to review the code, but I have a few
> quick comments.
>> Example usage:
>> % ipvsadm -A -t -s rr
>> % ipvsadm -a -t -r -m
>> # ...
>> # Source NAT for VIP
>> % iptables -t nat -A POSTROUTING -m ipvs --vaddr \
>> > --vport 80 -j SNAT --to-source
>> or SNAT-ing only a specific real server:
>> % iptables -t nat -A POSTROUTING --dst \
>> > -m ipvs --vaddr -j SNAT --to-source
> If the iptables rule is not in place does LVS just use
> its old NAT behaviour?

Yes, without iptables rules LVS NAT does DNAT.

>> First of all, thanks for all the feedback.  This is the changelog for v2:
>> - Make ip_vs_ftp work again.  Setup nf_conntrack expectations for
>>   related data connections (based on Julian's patch see
>> and let nf_conntrack/nf_nat do the
>>   packet mangling and the TCP sequence adjusting.
>>   This change rises the question how to deal with ip_vs_sync?  Does it
>>   work together with conntrackd?  Wild idea: what about getting rid of
>>   ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd?
>>   Any comments on this?
>    That sounds like a reasonable suggestion.
>    I think that ip_vs_sync came along before conntrackd
>    and no one has given much thought to merging the functionality.

Okay, I'll dig further in this direction.

To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

<Prev in Thread] Current Thread [Next in Thread>