LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-01-2009, 11:29 AM   #1
yaw55555
LQ Newbie
 
Registered: Apr 2009
Posts: 3

Rep: Reputation: 0
Question IPVS loadbalancing and IPTABLES Firewall issues


Hi all,
I have set up an IPVS loadbalancing for Web traffic that is working perfectly.

But now, I try to run my usual firewall script (IPTABLES commands) on the director server and packets seem to be blocked while being sent to Apache server.

firewall script looks like :

.....
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT
...

I can notice with ipvsadm counters that my http queries are taken into acccount and that director try to send packets to final server ..but nothing arrives on the Apache server.


Maybe IPTABLES and IPVS are not compliant ?
Many thanks for your ideas,

Last edited by yaw55555; 04-02-2009 at 03:11 AM.
 
Old 04-06-2009, 05:27 AM   #2
yaw55555
LQ Newbie
 
Registered: Apr 2009
Posts: 3

Original Poster
Rep: Reputation: 0
Hi all,
I cannot believe that I am the first to try IPVS and IPTABLES mixing...

I'm able to see that even without Firewalling, IPTABLES logs only INPUT packets (destinated to Virtual IP) , but no FORWARD or OUTPUT ..

So, if IPTABLES does not see OUTPUT packets, I am wondering why it blocks IPVS redirection.

Please help ...
 
Old 12-05-2012, 11:36 AM   #3
AlekZandre
LQ Newbie
 
Registered: Oct 2010
Posts: 1

Rep: Reputation: 0
I've solved this problem by adding iptables rule that ACCEPT packets with state NEW and INVALID from source RealServer
Sorry, but I don't know exactly which chain could be added this rule in, because I use one chain for INPUT and FORWARD:

iptables -t filter -A INPUT-FORWARD -m state --state NEW,INVALID -m tcp -p tcp -s source --sport source_port -j ACCEPT

source and source_port are Real Servers and Ports that used in IPVS (LVS). For simplicity, I use source_net instead few sources

Hope it will help somebody!

By the way I use LVS-NAT

Last edited by AlekZandre; 12-05-2012 at 11:47 AM. Reason: add info
 
  


Reply

Tags
firewall, iptable, ipvs, loadbalancing, open


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
LoadBalancing to Jboos linux2man Linux - Enterprise 4 06-24-2008 12:01 PM
Iptables with iptables-firewall.conf arno's matt3333 Slackware 16 06-28-2007 07:20 AM
info about ipvs and iptables entropia Linux - Security 1 01-25-2006 01:15 PM
Bridging+LoadBalancing---is it possible??? kartheekpn Linux - Networking 0 04-14-2005 02:07 PM
dns loadbalancing tzkolinux Linux - Networking 1 12-20-2004 11:40 PM


All times are GMT -5. The time now is 09:23 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration