I've set up a pair of redundant routers using keepalived and conntrackd. Part of their job is to handle routing to an FTP server in a NATted DMZ. both servers are running Ubuntu Lucid, but for other reasons I've switched to a stock 2.6.33.5 kernel. I've also tried building the 0.9.14 version of conntrack to see if it fixed the problem (lucid ships with 0.9.13). this works great, except that an existing FTP connection gets 'broken' when the master flips to the other machine. the data connection is fine, but the control connection seems to have broken sequence numbers - the leading four (or eight) bytes in the next packet sent is ignored. (example packet trace available off list). looking at the conntrack source code, it seems to suggest that the NAT 'sequence offset' should be replicated... but it clearly isn't being? am I supposed to match a particular version of conntrackd to the kernel? is NATted FTP not supported by conntrackd? -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
