0

The question is pretty straightforward as in the title, but almost everybody who I asks this to tries to convince me I'm crazy or stupid. I'll explain here why I need this, and I welcome other solutions to accomplish this task, but I'd still be very grateful if you can give me an answer (specially if it's not "no" :)) to the question.

So, I have a pool of machines on the same network (let's say, 10.0.0.1/24), their IPs are 10.0.0.1, 10.0.0.2, ..., 10.0.0.10

They also have a public internet IP (let's say, 8.8.8.8) configured on their loopback interface (ie, lo:dsr) [wait, don't call me crazy yet]

On top of this pool, I have a Direct Server Return load-balancer. If you don't know how it works, please check this out: http://www.weirdnet.nl/images/natvsdsr.png

So far so good, this works perfectly.

Now comes the problem. Those machines don't run a single service. They run 3 different services, on ports 8080, 8081 and 8082, and they communicate between themselves (via network).

So when service 8080 on machine A tries to contact service 8081 (via the load balancer IP, 8.8.8.8), Linux is "smart enough" to notice machine A owns the IP 8.8.8.8 and, instead, send this packet to the loopback interface.

Usually this is not a problem, but since it's a highly-available system, it will be a problem if, for whatever reason (a delivery, maybe), service B is stopped on machine A.

Improve this question
6
  • Why do the addresses need to be on lo instead of one of the actual interfaces? AFAIK, this is a simple routing issue in that the kernel will always see that 8.8.8.8 is local to "this" box, and route the traffic to itself via lo -- I stand to be corrected, but I don't see anyway the kernel would ever want to send traffic destined to an address it owns away from itself.
    – fukawi2
    Dec 24, 2013 at 4:05
  • Setting it as a loopback is a good idea also because it won't advertise ARP (which could steal the load balancer routing). But would it change anything if it were another interface? My hope is that it would be possible with iptables PREROUTING, or something like that.
    – Lem0n
    Dec 24, 2013 at 4:12
  • We do something similar, but never had the need to communicate with a service that could be on the same host via the LB (which is mostly because we have separate machines for each kind of service). In your case, I would suggest to remove the whole machine from the LB, deploy it, put it back in with ALL services running. While that sounds like more work, it is a simpler config at the end and the possibility to do mistakes is smaller ;)
    – zhenech
    Dec 24, 2013 at 12:11
  • Setting the addresses on lo is correct when the address is not associated with any particular physical interface. There's nothing wrong with that.
    – David Schwartz
    Dec 24, 2013 at 20:26
  • 1
    I would either set up another LB virtual server that's not using DSR on the 10. network and have your internal systems talk to that -or- Set up your load balancer checks such that one service failing pulls all of the services for that host out of rotation. I may be missing something in your problem though, as I don't see how 127.0.0.1 comes into play (other than it 'sharing' the lo interface).
    – user143703
    Dec 24, 2013 at 22:16

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .