Hi,
James Miller wrote:
Yes, but you can not run iptables/netfilter and maintain connection tracking with keepalived(vrrp).. so if you fail over, established/related traffic will not be known to .
For some folks this isn't an issue. For me is a show-stopper. I'm sure there are good reasons why the netfilter folks can't come up with conntrack state-sharing mechanism.
This is not true. Harald has published a paper last year at OLS2002, which gives an overview how connection tracking failover could be implemented for Netfilter. There are no theoretical problems with the approach, I've created some proof-of-concept code this spring. However, it's far from being usable in a real-world environment, at the moment, and this is the primary reason it has not been released to the public yet. You can get slightly more information from my presentation at the second Netfilter Workshop, available in OpenOffice.org Impress format at http://home.sch.bme.hu/~piglet/nf-ha/nfws_ha.sxi
--
Regards,
Krisztian KOVACS