|
> you instead just create a firewall rule saying "change the syn request
> destination IP address from VIP to my external IP so that the
> request goes
> to the VIP". Since the real server doesn't have an alias
^^^^^^^^^^^^
I meant to say "change the syn request destination IP frop VIP to external
IP so that the server can answer requests for the VIP".
P
PS - the only rules you need on the LVS director box is something like:
"echo 1 > /proc/sys/net/ipv4/ip_forward".
# allow HTTP/HTTPS traffic to vips
$IPTABLES -A INPUT -p tcp -j ACCEPT -i $EXT_INT -d $VIP1 --dport 80
$IPTABLES -A INPUT -p tcp -j ACCEPT -i $EXT_INT -d $VIP1 --dport 443
# icmp, vip 1
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type echo-reply -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type echo-request -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type
destination-unreachable -m limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type source-quench -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type time-exceeded -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $EXT_INT -p icmp -d $VIP1 --icmp-type
parameter-problem -m limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type echo-reply -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type echo-request -m
limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type
destination-unreachable -m limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type source-quench
-m limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type time-exceeded
-m limit --limit 5/second -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT_INT -p icmp -s $VIP1 --icmp-type
parameter-problem -m limit --limit 5/second -j ACCEPT
|
