Question: how did you set the scheduler to "n"? I don't see a choice for "none" in Piranha and I tried manually editing /etc/sysconfig/ha/lvs.cf with no luck. Even when I commented out the scheduler field it seems to default to wlc. Basically, I'm not sure that it's my iptables rules that are giving me a problem. Maybe it's what Christopher mentions below? How would I remove port 20 from LVS? I tried using a firewall mark of 20 and have Piranha configured to use 21 as the application port. I can ftp to the real servers using their real IPs but ftps to the VIP fail with the error on the ftp client "An existing connection was forcibly closed by the remote host." Persistence is set to 20 Here are the iptables rules I'm using # service iptables status Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 MARK tcp -- 0.0.0.0/0 VIP tcp dpts:10000:20000 MARK set 0x14 2 MARK tcp -- 0.0.0.0/0 VIP tcp dpt:20 MARK set 0x14 3 MARK tcp -- 0.0.0.0/0 VIP tcp dpt:21 MARK set 0x14 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0 tcp spts:1:65535 dpts:1:65535 Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination At 05:20 PM 4/4/2008, Johannes Russek wrote: >we use this together with firewall mark rule in lvs-DR (piranha) and scheduler "rr" and persistent = 20: > >-A PREROUTING -d $VIP-i eth0 -p tcp -m tcp --dport 10000:20000 -j MARK --set-mark 0x14 >-A PREROUTING -d $VIP -i eth0 -p tcp -m tcp --dport 20 -j MARK --set-mark 0x14 >-A PREROUTING -d $VIP -i eth0 -p tcp -m tcp --dport 21 -j MARK --set-mark 0x14 > >also vsftpd.conf is configured with > >pasv_min_port=10000 >pasv_max_port=20000 > >hope this helps? >regards, >johannes > >p.s.: of course the main firewall has to open the appropiate ports as well > >Christopher Hawkins schrieb: >>Never had to load balance it myself, but have heard of FTP over LVS issues >>due to lack of persistence (make sure it's on) and due to port 21 and 20 >>getting sent to different servers. The solution was to remove port 20 from >>LVS. With LVS NAT there is a special FTP module you can load, but it should >>not be required in LVS DR. Or are you sure the issue is iptables? >> >>Also I would suggest the LVS mailing list if someone here can't solve this >>quickly. ;-) >>-----Original Message----- >>From: linux-cluster-bounces@xxxxxxxxxx >>[mailto:linux-cluster-bounces@xxxxxxxxxx] On Behalf Of John Garrity >>Sent: Friday, April 04, 2008 3:03 PM >>To: linux clustering >>Subject: iptables rules for LVS-DR cluster >> >>I'm trying to get ftp working in a LVS DR cluster. I think it's the iptables >>rules that might be giving me a problem. I have http services working well. >>Can someone who has ftp working share their ip tables rules? I'm new at this >>so please go easy on me. Thanks! >>-- >>Linux-cluster mailing list >>Linux-cluster@xxxxxxxxxx >>https://www.redhat.com/mailman/listinfo/linux-cluster >> >>-- >>Linux-cluster mailing list >>Linux-cluster@xxxxxxxxxx >>https://www.redhat.com/mailman/listinfo/linux-cluster >> > >-- >Linux-cluster mailing list >Linux-cluster@xxxxxxxxxx >https://www.redhat.com/mailman/listinfo/linux-cluster -- Linux-cluster mailing list Linux-cluster@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/linux-cluster
