CLUSTERIP: no conntrack error

CLUSTERIP: no conntrack error

[Edison Figueira]

I configured CLUSTERIP in two boxes to make balancing proxy, and
apparently it all worked but I get several messages from "CLUSTERIP:
no conntrack.

Does anyone know what this message means?

How can I fix this?

Thank you.

Edison Figueira Junior

Re: CLUSTERIP: no conntrack error

[Jan Engelhardt]

On Wednesday 2010-07-14 00:18, Edison Figueira wrote:

>I configured CLUSTERIP in two boxes to make balancing proxy, and
>apparently it all worked but I get several messages from "CLUSTERIP:
>no conntrack.
>
>Does anyone know what this message means?

Means packets are tagged as INVALID.

Re: CLUSTERIP: no conntrack error

[Pablo Neira Ayuso]

On 25/07/10 18:34, Jan Engelhardt wrote:
> On Wednesday 2010-07-14 00:18, Edison Figueira wrote:
>
>> I configured CLUSTERIP in two boxes to make balancing proxy, and
>> apparently it all worked but I get several messages from "CLUSTERIP:
>> no conntrack.
>>
>> Does anyone know what this message means?
>
> Means packets are tagged as INVALID.

Indeed. You have to add a rule to drop invalid packets before the 
CLUSTERIP rule to avoid this message.

Re: CLUSTERIP: no conntrack error

[Jan Engelhardt]

On Monday 2010-07-26 12:35, Pablo Neira Ayuso wrote:
> On 25/07/10 18:34, Jan Engelhardt wrote:
>> On Wednesday 2010-07-14 00:18, Edison Figueira wrote:
>>
>>> I configured CLUSTERIP in two boxes to make balancing proxy, and
>>> apparently it all worked but I get several messages from "CLUSTERIP:
>>> no conntrack.
>>>
>>> Does anyone know what this message means?
>>
>> Means packets are tagged as INVALID.
>
> Indeed. You have to add a rule to drop invalid packets before the CLUSTERIP
> rule to avoid this message.

Hm, couldn't we just drop the message? There are many other components 
in Netfilter that silently bail out when nf_ct_get returns NULL, like 
xt_connlimit.

Re: CLUSTERIP: no conntrack error

[Pablo Neira Ayuso]

On 26/07/10 13:00, Jan Engelhardt wrote:
> On Monday 2010-07-26 12:35, Pablo Neira Ayuso wrote:
>> On 25/07/10 18:34, Jan Engelhardt wrote:
>>> On Wednesday 2010-07-14 00:18, Edison Figueira wrote:
>>>
>>>> I configured CLUSTERIP in two boxes to make balancing proxy, and
>>>> apparently it all worked but I get several messages from "CLUSTERIP:
>>>> no conntrack.
>>>>
>>>> Does anyone know what this message means?
>>>
>>> Means packets are tagged as INVALID.
>>
>> Indeed. You have to add a rule to drop invalid packets before the CLUSTERIP
>> rule to avoid this message.
>
> Hm, couldn't we just drop the message? There are many other components
> in Netfilter that silently bail out when nf_ct_get returns NULL, like
> xt_connlimit.

Yes, it's a good idea for the short run.

In the long run, we should deprecate CLUSTERIP since it has been 
superseded by the cluster match. However, I wanted to document the new 
approach before doing so (I found no spare time to do it).

IIRC, the message is only displayed if netfilter debugging is enabled.

Re: CLUSTERIP: no conntrack error

[Jan Engelhardt]

On Monday 2010-07-26 13:09, Pablo Neira Ayuso wrote:
>>>>
>>>> Means packets are tagged as INVALID.
>>>
>>> Indeed. You have to add a rule to drop invalid packets before the CLUSTERIP
>>> rule to avoid this message.
>>
>> Hm, couldn't we just drop the message? There are many other components
>> in Netfilter that silently bail out when nf_ct_get returns NULL, like
>> xt_connlimit.
>
> Yes, it's a good idea for the short run.
>
> In the long run, we should deprecate CLUSTERIP since it has been superseded by
> the cluster match. However, I wanted to document the new approach before doing
> so (I found no spare time to do it).
>
> IIRC, the message is only displayed if netfilter debugging is enabled.

pr_info it says.

Re: CLUSTERIP: no conntrack error

[Edison Figueira]

Thank you all for the replies. The DROP rule of INVALID packets resolved it.

Att.

Edison Figueira Junior

On Mon, Jul 26, 2010 at 8:13 AM, Jan Engelhardt <jengelh@medozas.de> wrote:
>
> On Monday 2010-07-26 13:09, Pablo Neira Ayuso wrote:
>>>>>
>>>>> Means packets are tagged as INVALID.
>>>>
>>>> Indeed. You have to add a rule to drop invalid packets before the CLUSTERIP
>>>> rule to avoid this message.
>>>
>>> Hm, couldn't we just drop the message? There are many other components
>>> in Netfilter that silently bail out when nf_ct_get returns NULL, like
>>> xt_connlimit.
>>
>> Yes, it's a good idea for the short run.
>>
>> In the long run, we should deprecate CLUSTERIP since it has been superseded by
>> the cluster match. However, I wanted to document the new approach before doing
>> so (I found no spare time to do it).
>>
>> IIRC, the message is only displayed if netfilter debugging is enabled.
>
> pr_info it says.
>

Re: CLUSTERIP: no conntrack error

[Pablo Neira Ayuso]

On 26/07/10 13:13, Jan Engelhardt wrote:
> 
> On Monday 2010-07-26 13:09, Pablo Neira Ayuso wrote:
>>>>>
>>>>> Means packets are tagged as INVALID.
>>>>
>>>> Indeed. You have to add a rule to drop invalid packets before the CLUSTERIP
>>>> rule to avoid this message.
>>>
>>> Hm, couldn't we just drop the message? There are many other components
>>> in Netfilter that silently bail out when nf_ct_get returns NULL, like
>>> xt_connlimit.
>>
>> Yes, it's a good idea for the short run.
>>
>> In the long run, we should deprecate CLUSTERIP since it has been superseded by
>> the cluster match. However, I wanted to document the new approach before doing
>> so (I found no spare time to do it).
>>
>> IIRC, the message is only displayed if netfilter debugging is enabled.
> 
> pr_info it says.

Then, it would better to use pr_debug instead.