Re: [Bugme-new] [Bug 9812] New: Kernel does not deliver packets going through the INPUT chain even if the app is listening on IN_ADDR_ANY

[Patrick McHardy <kaber@trash.net>]

Andrew Morton wrote:
>> On Fri, 25 Jan 2008 03:59:27 -0800 (PST) bugme-daemon@bugzilla.kernel.org wrote:
>> http://bugzilla.kernel.org/show_bug.cgi?id=9812
>>

>> Problem Description:
>>
>> I have a farm of web servers behind a load balancer in DSR mode.
>> I would like to be able to dump packets with any IP address on the web servers
>> through the load balancer and have web servers reply to these requests.
>> Currently for every IP web servers are supposed to reply to, I have to
>> configure the IP on all servers on their loopback interfaces. The web server
>> listens on IN_ADDR_ANY and I am forcing packets into the INPUT chain via
>> iptables/netfilter but the kernel never replies to any connection requests. I
>> only see the counter for OutNoRoutes increasing.
>>
>> Steps to reproduce:
>>
>> web server:
>>
>> #iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK --set-mark
>> 1 
>> #ip route add to local default dev lo protocol kernel table 1
>> #ip rule add fwmark 1 table 1 priority 1
>>
>> client:
>>
>> #ip route add 1.1.1.1/32 via <web server IP> dev eth0
>>
>> while making requests to 1.1.1.1:80 from the client you can see increasing
>> OutNoRoutes counter but no connection ever takes place.


I already commented in bugzilla, this is not a bug but an incorrect
setup. DNAT or REDIRECT must be used to make this work properly.