All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Ming-Ching Tiew" <mingching.tiew@redtone.com>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Split access, load balancing AND forwarding: HOW?
Date: Thu, 22 Feb 2007 02:58:24 +0000	[thread overview]
Message-ID: <000d01c7562d$51853570$02bca8c0@freelance> (raw)
In-Reply-To: <Pine.LNX.4.64.0702211529590.9170@dellareas.intoweb.co.za>


From: "Luciano Ruete" <luciano@lugmen.org.ar>
> 
> The solution is to use CONNTRACK from iptables, full example described in 
> this[1] e-mail from the archive. No patches needed.
> 
> [1] http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
>

I think you mean CONNMARK ( not CONNTRACK ) from iptables  ?

The ever popular routing command :-

>
> #route commands
> ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via y.y.y.y dev eth2
>

I personal view is that  ***NEVER*** use such a routing statement, or never let 
the system has a chance to use such a routing statement, especially when you are 
doing NAT. The email example above included this routing statement but it is 
not used because the  'ip rule' takes precedence. The multipath weighted cached
based routing is problematic.

I would say it would be better to re-order the the iptables command :-

#restore mark before ROUTING decision
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
#by-pass rules if it is already MARKed
iptables -t mangle -A POSTROUTING -m mark  --mark ! 0 -j ACCEPT 
#1st packets(from a connection) will arrive here 
iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 0x2
iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark

ie restore-mark is moved to the top.

I strongly recommend that the LARTC documentation be updated, especially it 
encourages people to use multipath weighted routing instead of iptables 
based solution.

Cheers.



_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

  parent reply	other threads:[~2007-02-22  2:58 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-02-21 14:10 [LARTC] Split access, load balancing AND forwarding: HOW? Andrew McGill
2007-02-22  2:16 ` Luciano Ruete
2007-02-22  2:58 ` Ming-Ching Tiew [this message]
2007-02-22  4:57 ` Ming-Ching Tiew
2007-02-23  2:54 ` Luciano Ruete
2007-02-23  3:06 ` Luciano Ruete
2007-02-23  3:48 ` Roy Orpiano
2007-02-23  7:23 ` Ming-Ching Tiew
2007-02-23 18:40 ` Alex Samad
2007-02-23 23:59 ` Ming-Ching Tiew

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='000d01c7562d$51853570$02bca8c0@freelance' \
    --to=mingching.tiew@redtone.com \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.