Latest LQ Deal: Linux Power User Bundle
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 04-01-2009, 12:29 PM   #1
LQ Newbie
Registered: Apr 2009
Posts: 3

Rep: Reputation: Disabled
Question IPVS loadbalancing and IPTABLES Firewall issues

Hi all,
I have set up an IPVS loadbalancing for Web traffic that is working perfectly.

But now, I try to run my usual firewall script (IPTABLES commands) on the director server and packets seem to be blocked while being sent to Apache server.

firewall script looks like :

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT

I can notice with ipvsadm counters that my http queries are taken into acccount and that director try to send packets to final server ..but nothing arrives on the Apache server.

Maybe IPTABLES and IPVS are not compliant ?
Many thanks for your ideas,

Last edited by yaw55555; 04-02-2009 at 04:11 AM.
Old 04-06-2009, 06:27 AM   #2
LQ Newbie
Registered: Apr 2009
Posts: 3

Original Poster
Rep: Reputation: Disabled
Hi all,
I cannot believe that I am the first to try IPVS and IPTABLES mixing...

I'm able to see that even without Firewalling, IPTABLES logs only INPUT packets (destinated to Virtual IP) , but no FORWARD or OUTPUT ..

So, if IPTABLES does not see OUTPUT packets, I am wondering why it blocks IPVS redirection.

Please help ...
Old 12-05-2012, 12:36 PM   #3
LQ Newbie
Registered: Oct 2010
Posts: 1

Rep: Reputation: 0
I've solved this problem by adding iptables rule that ACCEPT packets with state NEW and INVALID from source RealServer
Sorry, but I don't know exactly which chain could be added this rule in, because I use one chain for INPUT and FORWARD:

iptables -t filter -A INPUT-FORWARD -m state --state NEW,INVALID -m tcp -p tcp -s source --sport source_port -j ACCEPT

source and source_port are Real Servers and Ports that used in IPVS (LVS). For simplicity, I use source_net instead few sources

Hope it will help somebody!

By the way I use LVS-NAT

Last edited by AlekZandre; 12-05-2012 at 12:47 PM. Reason: add info


firewall, iptable, ipvs, loadbalancing, open

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
LoadBalancing to Jboos linux2man Linux - Enterprise 4 06-24-2008 01:01 PM
Iptables with iptables-firewall.conf arno's matt3333 Slackware 16 06-28-2007 08:20 AM
info about ipvs and iptables entropia Linux - Security 1 01-25-2006 02:15 PM
Bridging+LoadBalancing---is it possible??? kartheekpn Linux - Networking 0 04-14-2005 03:07 PM
dns loadbalancing tzkolinux Linux - Networking 1 12-21-2004 12:40 AM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:53 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration