Re: [LARTC] Load balancing using connmark

From: "Salim S I" <salim.si@cipherium.com.tw>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Load balancing using connmark
Date: Thu, 10 May 2007 06:15:23 +0000	[thread overview]
Message-ID: <000401c792ca$9ba1cdb0$5964a8c0@SalimSi> (raw)
In-Reply-To: <1178722806.7492.55.camel@vulcan.aspl>

[-- Attachment #1.1: Type: text/plain, Size: 1876 bytes --]

Francis Brosnan Blazquez wrote:
> Hi,
> 
> I've been implementing a load balancing solution using CONNMARK, based
> on solution described by Luciano Ruete at [1]. Gracias por el post y
por
> apuntar en la dirección correcta Luciano!
> 
> Once implemented, I've found that due to some reason packets aren't
> properly marked (or improperly remarked) and sent out using the wrong
> interface. 
> 
> <snip>
> 
> iptables -t mangle -A POSTROUTING -m mark  --mark ! 0 -j ACCEPT 
> iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 0x1
> iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 0x2
> iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark

This is wrong. POSTROUTING is exactly what is is _POST_ routing. By the
time you do your marks and stuff the kernel has _already_ assigned a
packet to an interface, and you can not alter this anymore.

> After a bit of testing with the second solution, it seems to behave
> better, doing all marking job at the PREROUTING and OUTPUT.

This is flawed too. OUTPUT suffers from the very same problem as
POSTROUTING - by the time the packets hit the NF stack the process has
already bound itself to an interface, which you can not change anymore.

Peter

Disagree with Peter. The marking in postrouting table is CONNMARK. This
is for marking the connection, which has already had a route decided for
it, so that all packets of the connection passes through this interface.
This marking is done for packets with NEW state, see the check for
mark==0 in the prev. line. The restore mark in PREROUTING will restore
the connmark and route the subsequent packets.
This approach will work, but you need some sort of stateful-ness in
netfilter.

The second point in Brosnan Blazquez’s mail about shorewall: They seem
to be doing Policy Routing, not real load balancing.

[-- Attachment #1.2: Type: text/html, Size: 9859 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc