LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: connection sync at failover, email, and using only basic IPmgmt

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: connection sync at failover, email, and using only basic IPmgmt
From: Dominik Klein <dk@xxxxxxxxxxxxxxxx>
Date: Tue, 14 Feb 2006 09:38:48 +0100
The scenario I see is an existing connection that matched firewall rules
getting dropped by the backup iptables rules when he switches to master
because his iptables state wasn't aware of the connection. Is that a
correct assessment?


More than likely, yes. I'm not aware of anything to sync the iptables
conntrack tables (which is what you're talking about).

Personally I think that a connection drop at router failover is
acceptable; it's rather better than having a complete outage.


Untested, but there seems to be something about ipvs and iptables connection states:
http://www.ssi.bg/~ja/nfct/

Regards
Dominik

ps. could someone please comment on my problem with preempt_delay posted last week? :)

<Prev in Thread] Current Thread [Next in Thread>