From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kovacs Krisztian Subject: Re: LVS and fault-tolerant Firewall. Date: Wed, 17 Sep 2003 10:09:35 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3F6816BF.4040006@balabit.hu> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: jimm@simutronics.com Cc: "LinuxVirtualServer.org users mailing list." , netfilter@lists.samba.org Hi, James Miller wrote: > Yes, but you can not run iptables/netfilter and maintain connection tracking > with keepalived(vrrp).. so if you fail over, established/related traffic > will not be known to . > > For some folks this isn't an issue. For me is a show-stopper. I'm sure > there are good reasons why the netfilter folks can't come up with conntrack > state-sharing mechanism. This is not true. Harald has published a paper last year at OLS2002, which gives an overview how connection tracking failover could be implemented for Netfilter. There are no theoretical problems with the approach, I've created some proof-of-concept code this spring. However, it's far from being usable in a real-world environment, at the moment, and this is the primary reason it has not been released to the public yet. You can get slightly more information from my presentation at the second Netfilter Workshop, available in OpenOffice.org Impress format at http://home.sch.bme.hu/~piglet/nf-ha/nfws_ha.sxi -- Regards, Krisztian KOVACS