Re: [LARTC] DNAT and Load Balancing [attached compresed file]

* Re: [LARTC] DNAT and Load Balancing [attached compresed file]
@ 2007-03-02  8:43 ArcosCom Linux User
  2007-03-02 11:13 ` Tom Lobato
  2007-03-02 11:45 ` ArcosCom Linux User
  0 siblings, 2 replies; 3+ messages in thread
From: ArcosCom Linux User @ 2007-03-02  8:43 UTC (permalink / raw)
  To: lartc

In the file "comandos.log" you can see how I implement the "load balancing".

The explanation is:
   1) Add more filters to routing decisions that depending on fwmark value
of packets use one or another link to send the packet.
   2) In PREROUTING mark the connection to know the "incoming" iface and
keep that into conntrack table.
   3) In POSTROUTING the same, to allow outgoing packages select the same
interface.

In my configuration wan0 is a bridge (without STP) that links all the WAN
interfaces and I make aliases for all, that is why you can see the
"physdev" match used, but if you don't use a bridge, you can replace the
wan0 and bridge selection by only your wan ifaces.

With this configuration, I expect these:
   1) Allow UPnP work fine (appears to be working for now).
   2) Allow the correct incoming DNAT work fine.
   3) Allow the correct outgoing conections tracks fine.
   4) Allow only 1 iptables rules if I need DNAT to one machine from any
wan iface (very usefull for p2p programs).

You can see, too, that I use masks with marks, that is because I use
another marks to allow traffic control (with other marks).

I'm testing this configuration for two days now, and appears to be working
fine.

Last note: This file is not my real script, my real script parse one
config file where I define all my wan ifaces, my real script generates
this files to allow me debug the command execution results, order, output,
etc...

Regards

El Vie, 2 de Marzo de 2007, 2:52, Manish Kathuria escribió:
> On 3/2/07, Tom Lobato <tomlobato@gmail.com> wrote:
>>
>>
>>     Hi all!
>>
>>
>>     After that good thread "DGD patch not detecting dead gateway" I was
>> able to set up a Load Balancing with ping based DGD (without Julian
>> Anastasov patch). But now I'm facing a new problem and tried some
>> options, with only partial solutions.
>>
>>     I made a script based on
>> http://www.mail-archive.com/lartc@mailman.ds9a.nl/msg16257.html (Thank
>> you Manish Kathuria), without Julian A. patch, and with routes/rules as
>> described in nano.txt. It works fine, but...
>>
>>     The problem: I do DNAT for internet located people to access my LAN
>> machines (VNC, RDP, etc...). It sometimes works, sometimes don't work.
>> It appears that the connection from outside can enter, but when reply
>> packets try to get back across nat machine, it falls into the round
>> robin default route selection to define its gateway. Well, of course,
>> this reply must leave the router via the same interface whose initial
>> packets entered.
>>
>>
>>     vnc initial
>> request packet      reply that got
>>             \                   wrong route
>>              \                       ^
>>               \                     /
>>               V                  /
>>               isp1 isp2 isp3
>>                _|____|____|__
>>               |                    |
>>               |      dnat      |
>>               |_____________|
>>                         ^
>>                          |
>>                          |
>>                         V
>>               LAN estation, the
>>                   vnc server
>>
>>
>>
>>     What I need is a way to force packets leave the router via the same
>> interface whose its request entered this.
>>     I'd like to hear opinions about the problem (and also solution =).
>> Remember, I can't apply the DGD patch from J.A. because it only checks
>> the first hop for dead detection.
>>     I will apreciate any help.
>>
>>     Thank you,
>>
>>
>>
>>     Tom Lobato
>>
>>
>> _______________________________________________
>> LARTC mailing list
>> LARTC@mailman.ds9a.nl
>> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>>
>
> I had overlooked this. I had also faced a similar problem.  There are
> two possible solutions, one is to apply Julian's patches because even
> though you are not using the patches for DGD, they do help in making
> NAT processing with multiple gateways work properly. The other option
> is to mark the packets using CONNTRACK. There was a good discussion on
> this topic some days back. You can check the thread using the
> following links to the archives:
>
> http://mailman.ds9a.nl/pipermail/lartc/2007q1/020354.html
> http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
>
> --
> Manish Kathuria
> Tux Technologies
> http://www.tuxtechnologies.co.in/
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

^ permalink raw reply	[flat|nested] 3+ messages in thread