Patrick McHardy wrote: > Pablo Neira Ayuso wrote: >> This patch adds the iptables cluster match. This match can be used >> to deploy gateway and back-end load-sharing clusters. Assuming that >> all the nodes see all packets (see arptables mcmangle target and >> PKTTYPE iptables targets on how to do that), the cluster match >> decides if this node has to handle a packet given: >> >> jhash(source IP) % nodeID == 0 >> >> For related connections, the master conntrack is used. An example of >> its use for a gateway cluster, in one of the cluster nodes: >> >> iptables -I PREROUTING -t mangle -i eth1 -m cluster \ >> --cluster-total-nodes 2 --cluster-local-node 1 \ >> --cluster-proc-name eth1 -j MARK --set-mark 0xffff >> iptables -A PREROUTING -t mangle -i eth1 \ >> -m mark ! --mark 0xffff -j DROP >> iptables -A PREROUTING -t mangle -i eth2 -m cluster \ >> --cluster-total-nodes 2 --cluster-local-node 1 \ >> --cluster-proc-name eth2 -j MARK --set-mark 0xffff >> iptables -A PREROUTING -t mangle -i eth2 \ > > While its simple and probably gives good distribution, using the > source IP like this has the major disadvantage that when one node > fails, all nodes need to change rulesets and the existing mapping > of connections becomes at least partially invalid. But this is the same problem that people have in fault-tolerant primary-backup stateful firewall setups. That's why the conntrack-tools are there, just in case that you want fault-tolerant stateful firewalls ;). > Also using conntrack data implies that this can't be used in the > raw table, which seems like the best place to drop foreign packets. Indeed, but this relies on the conntrack data to hash the same tuple for all the packets. Look at the numbers, they are not that bad, I'm getting ~45% more performance while having my two firewalls running (before one was idle in my primary-backup setup). -- "Los honestos son inadaptados sociales" -- Les Luthiers -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
