Re: connection sync at failover, email, and using only basic IPmgmt

[Dominik Klein <dk@xxxxxxxxxxxxxxxx>]

> > The scenario I see is an existing connection that matched firewall rules
> > getting dropped by the backup iptables rules when he switches to master
> > because his iptables state wasn't aware of the connection. Is that a
> > correct assessment?
>
> More than likely, yes. I'm not aware of anything to sync the iptables
> conntrack tables (which is what you're talking about).
>
> Personally I think that a connection drop at router failover is
> acceptable; it's rather better than having a complete outage.
Untested, but there seems to be something about ipvs and iptables 
connection states:
http://www.ssi.bg/~ja/nfct/

Regards
Dominik

ps. could someone please comment on my problem with preempt_delay posted 
last week? :)