Re: What's required for a stateful firewall + ipvs in 2.6 kernel?

[Brian Ghidinelli <brian@vfive.com>]

Grant Taylor wrote:
>> 1. Stateful iptables firewall
>> 2. LVS director (keepalived)
>> 3. DNAT, SNAT and fwmarks
>> 4. Connection synchronization for failover
> 
 > ...
> synchronized / failed over (4) between multiple boxen.  This does not 
> mean that it can not be done, just that it is not going to be documented 
> in the usual locations if it is possible.

That's the issue... there are a lot of posts about LVS and netfilter on 
Austintek.com and other sites but the dates range from 2000 to 2006 or 
so making it hard to figure out what's current.

In sysadmining, I don't really like to be the pioneer. :)  No one else 
has turned an RHEL box into a Firewall + LVS Director?


> It is my (mis)understanding that keepalived does not do the 
> synchronization, rather just the monitoring of things.  Conntrackd will 
> do the synchronization for NetFilter.

I believe keepalived synchronizes the LVS connections between ipvs on 
the two boxes.  There is a config option "lvs_sync_daemon_inteface" for 
this (as I understand it).

This is only half the picture though, and conntrackd appears to solve 
the other half by also keeping netfilter in sync about which connections 
are already established or related so iptables rules don't kill valid 
sessions.

So in the end I suppose the real question is whether or not anyone has 
successfully used the Antefacto patches on RHEL?  I will try the 
lvs-users mailing list for that one...

Thanks for the help Grant,


Brian