Pablo Neira Ayuso wrote:
This patch adds the iptables cluster match. This match can be used to deploy gateway and back-end load-sharing clusters. Assuming that all the nodes see all packets (see arptables mcmangle target and PKTTYPE iptables targets on how to do that), the cluster match decides if this node has to handle a packet given: jhash(source IP) % nodeID == 0 For related connections, the master conntrack is used. An example of its use for a gateway cluster, in one of the cluster nodes: iptables -I PREROUTING -t mangle -i eth1 -m cluster \ --cluster-total-nodes 2 --cluster-local-node 1 \ --cluster-proc-name eth1 -j MARK --set-mark 0xffff iptables -A PREROUTING -t mangle -i eth1 \ -m mark ! --mark 0xffff -j DROP iptables -A PREROUTING -t mangle -i eth2 -m cluster \ --cluster-total-nodes 2 --cluster-local-node 1 \ --cluster-proc-name eth2 -j MARK --set-mark 0xffff iptables -A PREROUTING -t mangle -i eth2 \
While its simple and probably gives good distribution, using the source IP like this has the major disadvantage that when one node fails, all nodes need to change rulesets and the existing mapping of connections becomes at least partially invalid. Also using conntrack data implies that this can't be used in the raw table, which seems like the best place to drop foreign packets. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
