IPTables Internal Load Balancing

Question

I'm trying to setup a load balancing within the same LAN using IPTables (if possible). My idea is to emulate our main load balancer, but within a virtual environment, all the servers are virtual machines by the way.

There is a Gateway server, which forwards traffic to and from the Virtual Servers and the Real World, and I want to use that Gateway to balance some traffic within that Virtual LAN.

My setup is:

• GatewayServer -> 2 interfaces: eth0(Public), eth2(Private; 10.x.y.0/24)
• ServerA -> 1 interface: eth2(Private; 10.x.y.0/24)
• ServerB -> 1 interface: eth2(Private; 10.x.y.0/24)

On ServerB there is 2 instances of a service, listening on ports 60003 and 60004.

My goal is to be able to open a connection from ServerA to GatewayServer:60002 and get balanced to ServerB on ports 60003 and 60004 in a Round Robin fashion.

I've been able to open connections to to ServerB from ServerA through GateWay server, but the connecion always reach ServerB on port 60003, and never the other one, 60004.

I have the Gateway set up this way:

-A POSTROUTING -i eth2 -s 10.x.y.0/24 -p tcp --dport 60002 -j DNAT --to-destination 10.x.y.18-10.x.y.18:60003-60004

-A POSTROUTING -o eth2 -j MASQUERADE

Sniffing on ServerB I see the packets comming from GatewayServer, but always hiting port 60003 as stated before.

Any idea?

Answer 1

You will need to check the version of the kernel you are running as kernels later than 2.6.11-rc1 have had the functionality you want to use removed. To find your kernel version use uname e.g.

uname -r 
2.6.32-71.el6.x86_64

From the iptables man page

In Kernels up to 2.6.10 you can add several --to-destination options. For those kernels, if you specify more than one destination address, either via an address range or multiple --to-destination options, a simple round-robin (one after another in cycle) load balancing takes place between these addresses. Later Kernels (>= 2.6.11-rc1) donât have theability to NAT to multiple ranges anymore.