Hello,Hi Julian and everyone on the list(s) =)
On Mon, 1 Sep 2003, Jim Miller wrote:
My use for LVS and the Antefacto patch is with non-NATed ip space (we
use IPs assiged to us from ARIN). I _do_ hope the patch will still
function.
You rely on antefacto patch for non-NAT? What is the usage?:
- DR/TUN real server uses director as default gateway?
- NEW/EST states for incoming packets?
BTW, I'm not sure what will happen if tcp-window-tracking.patch is used for DR/TUN, may be it expects bidirectional streams?
Jim
Regards
-- Julian Anastasov <ja@xxxxxx>
Well, I'm in the middle stages of setting up two linux server firewalls (iptables/netfilter - doing stateful firewalling) with keepalived (vrrp) and the LVS framework kernel patch, in a Master/Backup configuration (keepalive seems to like having the lvs framework to build on). The boxes are doing dynamic routing with ospf to our Cisco routers using Quagga 0.96.2 -- and except for having to remember how to implement route maps (bgp is injecting about 1500 routes into ospf ;), I'm very, very happy with Quagga's improvements/fixes to ospfd.
I was able to successfully apply the antefacto patch to 2.4.21 kernel source thanks to great advice from the authors (removing the ftp contrack part from the patch). And I was hoping the antefacto patch would help fix conn_track issues between the two firewalls (should the master go down, how will the backup know what's related/established vs new?); but, I've since learned that a mechanism doesn't yet exist for sharing connection tracking information between n+1 iptables/netfilter firewalls running keepalived (vrrp). Any established/related connections will be lost if the master goes down, but that's better than not being able to reconnect at all! So, to be honest, I'm not sure if the antefacto (or LVS) patch(s) really buy me anything at all. I was hoping some other folks have successfully set up something similar to this and might have some advice they'd like to share.
So far I've found vrrp does a great job in dealing with with fail over (if down).. but I've found some strangeness with pulling the cable (or just resetting) the backup -- the clients (win98 test/junk machines) on the internal lan (at times) seem to cache the MAC of the backup and they stop talking to the rest of the world. I'm sure it's just something goofy that I have mis-configured.
Anyway, that's what I'm trying to setup.
--Jim
