Julian Hagenauer írta:
Hi
If you packet would make it to the router and the router had this configuration:
- eth0: 192.168.1.0/24
- eth1: 192.168.1.0/24
the router cannot distinguish the subnets.
Why so complicated.
eth0: 192.168.1.4
eth1: 192.168.1.4
You can not assign the same ip to both servers.
How would the router route the packets???
If the servers are on the SAME PHYSICAL network then you get an IP
collision and they would deny to talk to the net... (Try this with 2
Winsucks computers... :) )
The routing is based on IP and not on MAC !!!
(Hostbased routing) would be enough. Sure the router can not distinguish between the IPs, but he could distinguish between the MACs, so would it be possible to do Masquerading based on MAC-Adresses?
But you'd not even get that far.
When you send a packet from a client to the server and this server has same IP
as the client (thus src and dst IP are the same), then the packet wouldn't
even make it to the router: it would be sent to itself.
Mhm, i don't understand that. Let me explain my setup in greater detail:
Server1---------|
|
|
|
Server2-------Router-------Client
|
|
DB
Well for this scenario you can set up some load-balancing...
1. With DNS-balancing.
This is not that list ... :)
2. With iptables balancing.
iptables man pages:
"
BALANCE
This allows you to DNAT connections in a round-robin way over a
given range of destination addresses.
--to-destination ipaddr-ipaddr
Address range to round-robin over.
"
"
DNAT
This target is only valid in the nat table, in the PREROUTING and
OUTPUT chains, and user-defined chains which are only called from those
chains. It specifies that the
destination address of the packet should be modified (and all
future packets in this connection will also be mangled), and rules
should cease being examined. It takes
one type of option:
--to-destination [ipaddr][-ipaddr][:port-port]
which can specify a single new destination IP address, an
inclusive range of IP addresses, and optionally, a port range (which is
only valid if the rule also
specifies -p tcp or -p udp). If no port range is
specified, then the destination port will never be modified. If no IP
address is specified then only the desti-
nation port will be modified.
In Kernels up to 2.6.10 you can add several
--to-destination options. For those kernels, if you specify more than
one destination address, either via an address
range or multiple --to-destination options, a simple
round-robin (one after another in cycle) load balancing takes place
between these addresses. Later Kernels
(>= 2.6.11-rc1) don't have the ability to NAT to multiple
ranges anymore.
"
Let assume these settings:
c (client)
192.168.1.52
s (virtual server)
192.168.1.4
s1 (server)
10.0.0.1
s2 (server)
10.0.0.2
s1---------\
|
|
|
s2-------Router-------c
|
|
DB
iptables -t nat -A PREROUTING -j BALANCE -d 192.168.1.4 --to-destination 10.0.0.1-10.0.0.2
iptables -t nat -A POSTROUTING -j SNAT -s 10.0.0.1 --to-source 192.168.1.4
iptables -t nat -A POSTROUTING -j SNAT -s 10.0.0.2 --to-source 192.168.1.4
Maybe this script is useful...
But maybe not... :)
You did not told us what kind of services will be on the servers...
Unfortunately with ftp these rules are not working... :)
I want that Server 1 and Server2 have the same IP, although only Server1 should be accessible for clients.
The reason for that is, that i want do some kind of load-balancing.
The problem is, that both Servers need permanent access to the db, so the router should somehow translate/masquerade the ip of the server2, so that both servers can access the db at the same time.
I know it sound weird :-)
Just a little bit... :)
Sincerely,
Julian
Swifty
