basic load distribution using -m statistic --mode nth

basic load distribution using -m statistic --mode nth

[Per Jessen]

I'm trying to set up basic load distribution using the following:

iptables -t nat -A OUTPUT  -d $addr -p udp --dport 53 -m
statistic --mode nth --every 2 --packet 0 -j DNAT --to $fe1
iptables -t nat -A OUTPUT  -d $addr -p udp --dport 53 -m
statistic --mode nth --every 2 --packet 1 -j DNAT --to $fe2

(I know I can achieve pretty much the same using "options rotate"
in resolv.conf, but humour me).

I'm testing the setup with a simple "dig <host>", and it seems
to be working, except that I get a hang ("no servers could be
reached") on every 4th query.  It is a consistently reproducable
behaviour.

I'm using iptables 4.0 and kernel 2.6.24.3.  Can anyone spot
anything I've missed?


thanks
Per Jessen, Zürich

Re: basic load distribution using -m statistic --mode nth

[Patrick McHardy]

Per Jessen wrote:
> I'm trying to set up basic load distribution using the following:
> 
> iptables -t nat -A OUTPUT  -d $addr -p udp --dport 53 -m
> statistic --mode nth --every 2 --packet 0 -j DNAT --to $fe1
> iptables -t nat -A OUTPUT  -d $addr -p udp --dport 53 -m
> statistic --mode nth --every 2 --packet 1 -j DNAT --to $fe2
> 
> (I know I can achieve pretty much the same using "options rotate"
> in resolv.conf, but humour me).
> 
> I'm testing the setup with a simple "dig <host>", and it seems
> to be working, except that I get a hang ("no servers could be
> reached") on every 4th query.  It is a consistently reproducable
> behaviour.
> 
> I'm using iptables 4.0 and kernel 2.6.24.3.  Can anyone spot
> anything I've missed?

DNAT is terminal, so you need:

rule 1: --every 2 --packet 0
rule 2: unconditional

Re: basic load distribution using -m statistic --mode nth

[Per Jessen]

Patrick McHardy wrote:

>
> DNAT is terminal, so you need:
>
> rule 1: --every 2 --packet 0
> rule 2: unconditional
>

Thanks Patrick!  Just what I needed.


/Per Jessen, Zürich

Re: basic load distribution using -m statistic --mode nth

[Per Jessen]

Per Jessen wrote:
> Patrick McHardy wrote:
> 
>> DNAT is terminal, so you need:
>>
>> rule 1: --every 2 --packet 0
>> rule 2: unconditional
>>
> 
> Thanks Patrick!  Just what I needed.


Hmm, I can't help wondering what the issue is in my second rule:


rule 1: --every 2 --packet 0
rule 2: --every 2 --packet 1

Why aren't they hit in a sequence of 1-2-1-2-1-2-1-2 etc ?


/Per Jessen, Zürich