Re: [lvs-users] Connecting directly to realservers in a one-network LVS-

To: " users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [lvs-users] Connecting directly to realservers in a one-network LVS-NAT
From: Joseph Mack NA3T <jmack@xxxxxxxx>
Date: Tue, 27 Nov 2007 04:15:19 -0800 (PST)
On Mon, 26 Nov 2007, Ben Hollingsworth wrote:

> Apparently, the forwarding rules get first dibs.  In my environment,
> when the director sees a packet come back from the private side that
> didn't first come through addressed to the VIP, then the director just
> acts as a router and dutifully forward the packet wherever it thinks it
> should go without NATting it.  No iptables or conntrack is used.
> BTW, in the default setup, the director merely sends an ICMP redirect
> back to the real server, which causes problems under some
> circumstances.  I had to set "net.ipv4.conf.default.send_redirects = 0"
> to get it to work consistently.

I think in the HOWTO I said to turn all these off.

> What we ended up doing was dissolving the private subnet entirely.  Each
> RS thinks that it's on a /32 (1-host) subnet that contains only itself.
> We forced a routing rule that tells it the default route is to the
> virtual gateway on eth0, even though it doesn't have a subnet route for
> that gateway.  The RS routing table looks like this:
> # netstat -rn
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
> UH        0 0          0 eth0
>         UG        0 0          0 eth0
> is the virtual gateway on the director.  The down side
> here is that any communication amongst the RS's gets bounced off the
> director.

In the HOWTO I setup hostroutes for the realservers and they 
talk to each other bouncing off the director.

> In our low-volume environment, that's not a problem.  We're
> balancing for availability, not throughput.
> Does this all make sense?  Are you all cringing yet?  We didn't exactly
> plan this layout; it's just where we ended up after we'd fixed all the
> problems we encountered along the way.

sounds fine to me. I'll add it to the one-network NAT 
section sometime.


Joseph Mack NA3T EME(B,D), FM05lw North Carolina
jmack (at) wm7d (dot) net - azimuthal equidistant map
generator at
Homepage It's GNU/Linux!

<Prev in Thread] Current Thread [Next in Thread>