lvs_nat blocking port?

["Daniel A. Nobuto" <ramune@xxxxxxxxxxxxx>]

Hi all,

        I've set up a small LVS_NAT-based http load
balancer but can't seem to connect to the realservers
behind them via IP on port 80.
        Connections to other ports are fine.  Is there
any way to get LVS to let someone hit a real server
directly?
        Network config:

Director:
Linux 2.4.x
eth0: 10.0.0.2 mask /24
default gw: 10.0.0.1
tun0: 10.0.2.1 mask /32
tun1: 10.0.2.2 mask /32

DIP == VIP

Real Server 1:
user-mode-linux 2.4.x
eth0: 10.0.1.2 linked to tun0 on director.
default gw: 10.0.2.1

Real Server 2:
user-mode-linux 2.4.x
eth0: 10.0.1.3 linked to tun0 on director.
default gw: 10.0.2.2

I can connect to/from any port on the real servers
except port 80, which I've set up to round-robin.

Connecting to 10.0.0.2:80 gives me the correct
results, ssh'ing into 10.0.1.[2,3] works, and
connections from the UML images to external hosts
works.

Trying to connect directly to the real servers
on port 80, though, translates everything correctly,
but generates an ICMP port unreach.  Don't have
tcpdump output right now, sorry.

Anyone dealt with something like this before?

-- DN
Daniel