Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup a basic load balancer for http and https based on IPVS and linux virtual server. I start and configure ldirectord with the following configuration:

virtual = 172.22.9.100:80
        real = 192.168.8.1:80 masq
        real = 192.168.8.2:80 masq
        checkport = 80
        checktimeout = 60
        checktype = ping
        emailalertstatus = all
        failurecount = 3
        protocol = tcp
        quiescent = yes
        scheduler = rr
        service = http

That means I have one virtual server with the virtual IP of 172.22.9.100 which takes alle http / https requests and routes them to one of the real servers via the round robin scheduling algorithm.

When I test the setup with a simple wget command:

# wget 172.22.9.100

i get a "Connection timed out" after a while, although all the computers are pingable from every other one.

If, however I setup the following iptables rule on the load balancer:

# iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 172.22.9.100

everything works fine. So here is my question: Why should I setup such iptables rule? Is the IPVS virtual server not supposed to do that internaly on its own? or I am missing some configuration option? Please, shed some light on this, it has been bothering me for a while now.

Any ideas and oppinions are more than welcome!

Cheers and thanks in advance :)

share|improve this question
    
Something like HAProxy will do this for you without any iptables magic, so it's probably a matter of configuration (or maybe ldirectord has a small amount of features) –  gparent Feb 7 '13 at 16:18
1  
Is the load balancer the default gateway for the backend servers? –  mgorven Feb 7 '13 at 17:39
    
Actually, no, the default gateway on the real servers is no the director IP. It cannot be changed, and the customer running the real server does not want to change this configuration. Is there another way to make LVS NAT function properly without completely messing up the real server network configuration? –  Konstantin Boyanov Feb 15 '13 at 12:47
    
No. That is why we choose LVS NAT, not to change any of the configuration on the real servers. –  Konstantin Boyanov Feb 15 '13 at 13:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.