Re: [PATCH 3/3] netfilter: xtables: add cluster match

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> This patch adds the iptables cluster match. This match can be used
>> to deploy gateway and back-end load-sharing clusters. Assuming that
>> all the nodes see all packets (see arptables mcmangle target and
>> PKTTYPE iptables targets on how to do that), the cluster match
>> decides if this node has to handle a packet given:
>>
>>     jhash(source IP) % nodeID == 0
>>
>> For related connections, the master conntrack is used. An example of
>> its use for a gateway cluster, in one of the cluster nodes:
>>
>> iptables -I PREROUTING -t mangle -i eth1 -m cluster \
>>     --cluster-total-nodes 2 --cluster-local-node 1 \
>>     --cluster-proc-name eth1 -j MARK --set-mark 0xffff
>> iptables -A PREROUTING -t mangle -i eth1 \
>>     -m mark ! --mark 0xffff -j DROP
>> iptables -A PREROUTING -t mangle -i eth2 -m cluster \
>>     --cluster-total-nodes 2 --cluster-local-node 1 \
>>     --cluster-proc-name eth2 -j MARK --set-mark 0xffff
>> iptables -A PREROUTING -t mangle -i eth2 \
> 
> While its simple and probably gives good distribution, using the
> source IP like this has the major disadvantage that when one node
> fails, all nodes need to change rulesets and the existing mapping
> of connections becomes at least partially invalid.

But this is the same problem that people have in fault-tolerant
primary-backup stateful firewall setups. That's why the conntrack-tools
are there, just in case that you want fault-tolerant stateful firewalls ;).

> Also using conntrack data implies that this can't be used in the
> raw table, which seems like the best place to drop foreign packets.

Indeed, but this relies on the conntrack data to hash the same tuple for
all the packets.

Look at the numbers, they are not that bad, I'm getting ~45% more
performance while having my two firewalls running (before one was idle
in my primary-backup setup).

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers