|
Simon Kirby <sim@xxxxxxxxxx> wrote:
> We have been successfully using nft dnat and IPVS in DR mode on 4.9, 4.14
> kernels, but since upgrading to 4.19, such rules now appear to miss the
> IPVS input hook and instead appear to hit localhost (and "tcpdump -ni lo"
> shows the packets) instead of being forwarded to a real server.
>
> I bisected this to 9971a514ed2697e542f3984a6162eac54bb1da98 ("netfilter:
> nf_nat: add nat type hooks to nat core").
>
> It should be pretty easy to see this with a minimal setup:
>
> /etc/nftables.conf:
>
> table ip nat {
> chain prerouting {
> type nat hook prerouting priority 0;
>
> ip daddr $ext_ip dnat to $vip
> }
> chain postrouting {
> type nat hook postrouting priority 100;
>
> # In theory this hook no longer needed since this commit,
> # but we also need to do some unrelated snatting.
> }
> }
>
> /etc/sysctl.conf:
>
> net.ipv4.conf.all.accept_local = 1
> net.ipv4.vs.conntrack = 1
>
> IPVS DR setup:
>
> ipvsadm -A -t $vip:80 -s wrr
> ipvsadm -a -t $vip:80 -r $real_ip:80 -g -w 100
I have a hard time figuring out how to expand $ext_ip, $vip and $real_ip,
and where to place those addresses on the nft machine.
|
