From: W Agtail <wagtail@iol.ie>
To: netdev@vger.kernel.org
Subject: two gateways with one NIC
Date: Sun, 08 Apr 2007 04:35:53 +0100 [thread overview]
Message-ID: <1176003353.686.45.camel@owl.home.ie> (raw)
Hope you can help.
I have the following setup using LVS (Linux Virtual Servers):
LAN--------------------192.168.0.0/24----------------- <= CLIENTS
| |
| |
LVS1 LVS2
vip1: 192.168.0.111 vip2: 192.168.0.121
eth0: 192.168.0.110 eth0: 192.168.0.120
eth1: 10.18.35.10 eth1: 10.18.35.20
gw1: 10.18.35.11 gw2: 10.18.35.21
| |
| |
LAN--------------------10.18.35.0/24-----------------
| |
| |
Apache> WEB1 10.18.35.51:8088 WEB2 10.18.35.52:8088
Apache> WEB1 10.18.35.51:8089 WEB2 10.18.35.52:8088
### LVS ###
The two LVS servers have a VIP and a GW.
LVS1 & LVS2 have ip_forward set to 1.
LVS1 has the following iptables:
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.111
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 192.168.0.111
with ipvsadm forwarding vip1:8088 to web1:8088 & web2:8088
LVS2 has the following iptables:
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.121
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 192.168.0.121
with ipvsadm forwarding vip1:8089 to web1:8089 & web2:8089
### WEB ###
The two Web servers have 2 virtual web servers listening on ports 8088 &
8089 and have the following iptables & iproute2 config:
iptables -t mangle -A PREROUTING -p tcp --dport 8088 -i eth0 -j MARK
--set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 8089 -i eth0 -j MARK
--set-mark 2
ip route add table 1 default via 10.18.35.11 dev eth0
ip route add table 2 default via 10.18.35.21 dev eth0
ip rule add fwmark 1 table 1
ip rule add fwmark 2 table 2
WEB1's default GW is set to gw1.
WEB2's default GW is set to gw2.
CLIENTS should be able to connect to vip1:8088 and vip2:8089
### MY PROBLEM ###
If i set WEB2's default GW to gw1, everything works as expected (as I
now only have one GW).
But when trying to set WEB2's default GW to gw2, things don't work.
For example, if i was to run: curl vip1:8088 from a CLIENT, I would be
able to connect to web1:8088 via LVS OK, but unable to connect to
web2:8088 should LVS take me to web2.
Its as though the iptables/ip route settings are not working as they
should.
Any ideas what I'm doing wrong?
Many thanks, W Agtail.
next reply other threads:[~2007-04-08 3:35 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-04-08 3:35 W Agtail [this message]
2007-04-08 15:01 ` two gateways with one NIC Lennart Sorensen
2007-04-08 16:10 ` W Agtail
2007-04-08 18:22 ` Lennart Sorensen
2007-04-08 19:29 ` W Agtail
2007-04-09 14:54 ` Lennart Sorensen
2007-04-09 15:56 ` W Agtail
2007-04-09 16:11 ` Lennart Sorensen
2007-04-09 16:13 ` Patrick McHardy
2007-04-09 16:19 ` Lennart Sorensen
2007-04-09 17:02 ` W Agtail
2007-04-09 17:14 ` Patrick McHardy
2007-04-09 17:23 ` Lennart Sorensen
2007-04-09 18:05 ` W Agtail
2007-04-09 18:11 ` Ben Greear
2007-04-10 13:46 ` W Agtail
2007-04-10 15:32 ` Ben Greear
2007-04-11 15:38 ` W Agtail
2007-04-09 18:11 ` Lennart Sorensen
2007-04-09 18:24 ` W Agtail
2007-04-09 21:23 ` Lennart Sorensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1176003353.686.45.camel@owl.home.ie \
--to=wagtail@iol.ie \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).