LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: [lvs-users] stuck on LVS-TUN, realservers receiving ipip packet, but

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [lvs-users] stuck on LVS-TUN, realservers receiving ipip packet, but not doing anything because it think's it's martian.
From: Joseph Mack NA3T <jmack@xxxxxxxx>
Date: Wed, 14 Oct 2009 07:40:51 -0700 (PDT)
On Wed, 14 Oct 2009, Vincent Young wrote:

> Linode is a VPS hosting company using Xen virtual servers, and i'm
> being hosted with them at the moment.

there are minor wrinkles running LVS under Xen. Look at the 
HOWTO.

>>> So i decided to use LVS-TUN.
>
> Linode has the option of deploying your environment in 4 datacenters,
> and i figured it would be good to be able to have the flexibility to
> connect outside my datacenter when the need should arise.

make sure you understand the consequences of a packet with 
src_addr=VIP from one datacenter emerging from another 
datacenter. It appears to be a spoofed packet.

> I'll give that a try, But the documentation I was reading on my linode
> said that my Linode only have one virtual ethernet interface -eth0, so
> that is why I needed to assign my private ip as an alias on that
> interface.

iproute2 handles this.

>>> director: cannot ping realserver
>>
>> you need to fix this. I assume this is your problem.
>
> ping stops working once I added the tunl0 device to my realserver with
> the following command:
> /sbin/ifconfig tunl0 97.107.133.234 netmask 255.255.255.255 broadcast
> 97.107.133.234

ping to the RIP (has to work) or to the VIP (won't work)?

>
>
> before I added that, I'm able to ping the real server from the
> director no problem. Is there something I should be doing to get it to
> work?
>
>
>>
>>> or telnet port 80 into realserver eth0 public ip.
>>
>> this test doesn't tell you anything if you can't ping the
>> realserver. After you can ping the realserver, you still
>> won't be able to connect to the realserver:VIP:80. Do you
>> understand why?
>
> Which is why I used a different client to do my tests. Is the reason
> because I'll just be connecting locally, and not actually go through
> the VIP?

yes

>> if so, turn off blocking martians.
>
> Is this controlled at the router level?

on the machine that's seeing the martian.

> or on the realserver? Im on a
> VPS, and dont have access to the physical machines themselves or the
> hardware like routers.

a common problem when setting up LVS. If you're doing it all 
in a single Xen, then you'll be routing within the Xen too.

Joe
-- 
Joseph Mack NA3T EME(B,D), FM05lw North Carolina
jmack (at) wm7d (dot) net - azimuthal equidistant map
generator at http://www.wm7d.net/azproj.shtml
Homepage http://www.austintek.com/ It's GNU/Linux!

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

<Prev in Thread] Current Thread [Next in Thread>