* About cluster deployments.
@ 2012-12-07 16:27 Humberto Jucá
2012-12-10 6:21 ` Arnoud Tijssen
0 siblings, 1 reply; 6+ messages in thread
From: Humberto Jucá @ 2012-12-07 16:27 UTC (permalink / raw)
To: netfilter
Hi all,
I'd like to know the group opnion about available GPL cluster
solutions. At the moment I'm working with a solution based on ucarp
(vip address) and rsync (conf
syncs) without synchronizing the conntrack table - im using active /
passive model.
I'm adopting a configuration with two ucarp groups. One group
determines which firewall will be dedicated to Internet control and
other is for internal control.
The most suitable configuration into Internet has been keepalived + conntrackd.
I think it's a great alternative, but ... I'm having some doubts.
What do you think of implementations with CLUSTERIP?
I did some tests, but found it a bit unstable. Maybe for my mistakes.
I found articles criticizing and others saying that the target
CLUSTERIP will sync the conntrack table too. It's true?
To synchronize the configuration i thought about using the DRDB, but i
found it very complex to manage - increases the difficulty in adding
or removing nodes. In tests that i did, I prefer GlusterFS. But i'm
undecided. I still think rsync the most simple, secure and fast way
to synchronize settings. In my opinion the other methods amplify the
complexity unnecessarily (for firewalls).
I found articles defending the cluster configuration with corosync + pacemaker.
It seems a fairly complete solution, but thought is not ideal for firewall.
I intend to test models with active/active, but there isn't much
documentation on the subject.
What opinion do you have about it (cluster solutions)?
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: About cluster deployments.
2012-12-07 16:27 About cluster deployments Humberto Jucá
@ 2012-12-10 6:21 ` Arnoud Tijssen
2012-12-11 10:19 ` Humberto Jucá
0 siblings, 1 reply; 6+ messages in thread
From: Arnoud Tijssen @ 2012-12-10 6:21 UTC (permalink / raw)
To: Humberto Jucá, netfilter@vger.kernel.org
For IPTables have a look at:
http://www.linuxjournal.com/article/10964
________________________________________
From: netfilter-owner@vger.kernel.org [netfilter-owner@vger.kernel.org] On Behalf Of Humberto Jucá [betolj@gmail.com]
Sent: Friday, December 07, 2012 5:27 PM
To: netfilter@vger.kernel.org
Subject: About cluster deployments.
Hi all,
I'd like to know the group opnion about available GPL cluster
solutions. At the moment I'm working with a solution based on ucarp
(vip address) and rsync (conf
syncs) without synchronizing the conntrack table - im using active /
passive model.
I'm adopting a configuration with two ucarp groups. One group
determines which firewall will be dedicated to Internet control and
other is for internal control.
The most suitable configuration into Internet has been keepalived + conntrackd.
I think it's a great alternative, but ... I'm having some doubts.
What do you think of implementations with CLUSTERIP?
I did some tests, but found it a bit unstable. Maybe for my mistakes.
I found articles criticizing and others saying that the target
CLUSTERIP will sync the conntrack table too. It's true?
To synchronize the configuration i thought about using the DRDB, but i
found it very complex to manage - increases the difficulty in adding
or removing nodes. In tests that i did, I prefer GlusterFS. But i'm
undecided. I still think rsync the most simple, secure and fast way
to synchronize settings. In my opinion the other methods amplify the
complexity unnecessarily (for firewalls).
I found articles defending the cluster configuration with corosync + pacemaker.
It seems a fairly complete solution, but thought is not ideal for firewall.
I intend to test models with active/active, but there isn't much
documentation on the subject.
What opinion do you have about it (cluster solutions)?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: About cluster deployments.
2012-12-10 6:21 ` Arnoud Tijssen
@ 2012-12-11 10:19 ` Humberto Jucá
2012-12-11 10:28 ` Arnoud Tijssen
2012-12-13 11:12 ` Pablo Neira Ayuso
0 siblings, 2 replies; 6+ messages in thread
From: Humberto Jucá @ 2012-12-11 10:19 UTC (permalink / raw)
To: Arnoud Tijssen; +Cc: netfilter
Hi, thanks for response!
But I like to known what were your experiences.
You already made active/active configurations?
How you handled the traffic to the two firewalls?
Worked with multicast arp or port mirroring?
I believe that working with multicast arp is better.
But, I must confirm that the gateways with firewall support this
feature as well.
A few years ago I tested pfsync + carp from a unix Openbsd.
There is a feature called arp balance - there is something in Linux?
I was impressed, but i prefer the netfilter resources (i think most flexible) .
What do you have configured?
What wasn't good? And what was cool?
I've read several documentations for linux.
I'm opening this thread to help me to define the best methodology and
make my scripts more expert!
2012/12/10 Arnoud Tijssen <ATijssen@ram.nl>:
> For IPTables have a look at:
>
> http://www.linuxjournal.com/article/10964
>
>
> ________________________________________
> From: netfilter-owner@vger.kernel.org [netfilter-owner@vger.kernel.org] On Behalf Of Humberto Jucá [betolj@gmail.com]
> Sent: Friday, December 07, 2012 5:27 PM
> To: netfilter@vger.kernel.org
> Subject: About cluster deployments.
>
> Hi all,
>
> I'd like to know the group opnion about available GPL cluster
> solutions. At the moment I'm working with a solution based on ucarp
> (vip address) and rsync (conf
> syncs) without synchronizing the conntrack table - im using active /
> passive model.
>
> I'm adopting a configuration with two ucarp groups. One group
> determines which firewall will be dedicated to Internet control and
> other is for internal control.
>
> The most suitable configuration into Internet has been keepalived + conntrackd.
> I think it's a great alternative, but ... I'm having some doubts.
>
> What do you think of implementations with CLUSTERIP?
> I did some tests, but found it a bit unstable. Maybe for my mistakes.
> I found articles criticizing and others saying that the target
> CLUSTERIP will sync the conntrack table too. It's true?
>
> To synchronize the configuration i thought about using the DRDB, but i
> found it very complex to manage - increases the difficulty in adding
> or removing nodes. In tests that i did, I prefer GlusterFS. But i'm
> undecided. I still think rsync the most simple, secure and fast way
> to synchronize settings. In my opinion the other methods amplify the
> complexity unnecessarily (for firewalls).
>
> I found articles defending the cluster configuration with corosync + pacemaker.
> It seems a fairly complete solution, but thought is not ideal for firewall.
>
> I intend to test models with active/active, but there isn't much
> documentation on the subject.
>
> What opinion do you have about it (cluster solutions)?
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: About cluster deployments.
2012-12-11 10:19 ` Humberto Jucá
@ 2012-12-11 10:28 ` Arnoud Tijssen
2012-12-13 11:12 ` Pablo Neira Ayuso
1 sibling, 0 replies; 6+ messages in thread
From: Arnoud Tijssen @ 2012-12-11 10:28 UTC (permalink / raw)
To: Humberto Jucá; +Cc: netfilter@vger.kernel.org
I just tested this setup for the sake of administration.
Not everybody is very familiar with the cli and a good Linux IPTables cluster was untill recently not really an option unless scripting was your second nature.
I tested it in an active-passive setup, which worked pretty good.
It is based on keepalived and conntrackd, thuis implementing multicast.
Although it takes some time to configure it properly and I haven`t tested a active-active setup.
From previous experiences I can vouch for the OpenBSD together with CARP.
That worked like a charm. But then again I used no gui so a clustered pfsense setup could be a good alternative there.
Hope this helps.
Cheers
________________________________________
From: Humberto Jucá [betolj@gmail.com]
Sent: Tuesday, December 11, 2012 11:19 AM
To: Arnoud Tijssen
Cc: netfilter@vger.kernel.org
Subject: Re: About cluster deployments.
Hi, thanks for response!
But I like to known what were your experiences.
You already made active/active configurations?
How you handled the traffic to the two firewalls?
Worked with multicast arp or port mirroring?
I believe that working with multicast arp is better.
But, I must confirm that the gateways with firewall support this
feature as well.
A few years ago I tested pfsync + carp from a unix Openbsd.
There is a feature called arp balance - there is something in Linux?
I was impressed, but i prefer the netfilter resources (i think most flexible) .
What do you have configured?
What wasn't good? And what was cool?
I've read several documentations for linux.
I'm opening this thread to help me to define the best methodology and
make my scripts more expert!
2012/12/10 Arnoud Tijssen <ATijssen@ram.nl>:
> For IPTables have a look at:
>
> http://www.linuxjournal.com/article/10964
>
>
> ________________________________________
> From: netfilter-owner@vger.kernel.org [netfilter-owner@vger.kernel.org] On Behalf Of Humberto Jucá [betolj@gmail.com]
> Sent: Friday, December 07, 2012 5:27 PM
> To: netfilter@vger.kernel.org
> Subject: About cluster deployments.
>
> Hi all,
>
> I'd like to know the group opnion about available GPL cluster
> solutions. At the moment I'm working with a solution based on ucarp
> (vip address) and rsync (conf
> syncs) without synchronizing the conntrack table - im using active /
> passive model.
>
> I'm adopting a configuration with two ucarp groups. One group
> determines which firewall will be dedicated to Internet control and
> other is for internal control.
>
> The most suitable configuration into Internet has been keepalived + conntrackd.
> I think it's a great alternative, but ... I'm having some doubts.
>
> What do you think of implementations with CLUSTERIP?
> I did some tests, but found it a bit unstable. Maybe for my mistakes.
> I found articles criticizing and others saying that the target
> CLUSTERIP will sync the conntrack table too. It's true?
>
> To synchronize the configuration i thought about using the DRDB, but i
> found it very complex to manage - increases the difficulty in adding
> or removing nodes. In tests that i did, I prefer GlusterFS. But i'm
> undecided. I still think rsync the most simple, secure and fast way
> to synchronize settings. In my opinion the other methods amplify the
> complexity unnecessarily (for firewalls).
>
> I found articles defending the cluster configuration with corosync + pacemaker.
> It seems a fairly complete solution, but thought is not ideal for firewall.
>
> I intend to test models with active/active, but there isn't much
> documentation on the subject.
>
> What opinion do you have about it (cluster solutions)?
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: About cluster deployments.
2012-12-11 10:19 ` Humberto Jucá
2012-12-11 10:28 ` Arnoud Tijssen
@ 2012-12-13 11:12 ` Pablo Neira Ayuso
1 sibling, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2012-12-13 11:12 UTC (permalink / raw)
To: Humberto Jucá; +Cc: Arnoud Tijssen, netfilter
Hi Humberto,
On Tue, Dec 11, 2012 at 07:19:36AM -0300, Humberto Jucá wrote:
> Hi, thanks for response!
>
> But I like to known what were your experiences.
>
> You already made active/active configurations?
> How you handled the traffic to the two firewalls?
> Worked with multicast arp or port mirroring?
For active/active firewalls/gatewyas, you will have to use arptables +
the cluster match. The CLUSTERIP target is designed to only work for
backend servers.
^ permalink raw reply [flat|nested] 6+ messages in thread
* About cluster deployments.
@ 2012-12-07 16:21 Humberto Jucá
0 siblings, 0 replies; 6+ messages in thread
From: Humberto Jucá @ 2012-12-07 16:21 UTC (permalink / raw)
To: netfilter
Hi all,
I'd like to know the group opnion about available GPL cluster solutions. At the
moment I'm working with a solution based on ucarp (vip address) and rsync (conf
syncs) without synchronizing the conntrack table - im using active /
passive model.
I'm adopting a configuration with two ucarp groups. One group determines which
firewall will be dedicated to Internet control and other is for
internal control.
The most suitable configuration into Internet has been keepalived + conntrackd.
I think it's a great alternative, but ... I'm having some doubts.
What do you think of implementations with CLUSTERIP?
I did some tests, but found it a bit unstable. Maybe for my mistakes.
I found articles
criticizing and others saying that the target CLUSTERIP will sync the
conntrack table
too. It's true?
To synchronize the configuration i thought about using the DRDB, but i
found it very
complex to manage - increases the difficulty in adding or removing
nodes. In tests
that i did, I prefer GlusterFS. But i'm undecided. I still think rsync
the most simple,
secure and fast way to synchronize settings. In my opinion the other
methods amplify
the complexity unnecessarily (for firewalls).
I found articles defending the cluster configuration with corosync + pacemaker.
It seems a fairly complete solution, but thought is not ideal for firewall.
I intend to test models with active/active, but there isn't much
documentation on the subject.
What opinion do you have about it (cluster solutions)?
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-12-13 11:12 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-12-07 16:27 About cluster deployments Humberto Jucá
2012-12-10 6:21 ` Arnoud Tijssen
2012-12-11 10:19 ` Humberto Jucá
2012-12-11 10:28 ` Arnoud Tijssen
2012-12-13 11:12 ` Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2012-12-07 16:21 Humberto Jucá
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).