Tag Info

New answers tagged

1

Here's another approach. Instead of marking connections based upon packet count and hoping they don't get reinitialized, duplicated, or otherwise altered, just divide the packets up by source or destination IP. For any sufficiently large set of connections, you should have about a 50-50 spread. I'm posting the following as a drop-in replacement, but you ...


0

The best way to debug an ELB issue is to do the following: Ensure the security groups on the instance(s) are setup to allow the incoming port (80) Make sure your health check is setup correctly tail -f (or similar) the logs of the instance(s) you're trying to add to the balancer. See that the ELB is correctly pinging the instance(s) An example ping ...


0

OP stated in comment that this setting solved the wrong IP problem. real_ip_header X-Forwarded-For; set_real_ip_from 0.0.0.0/0; However, the set_real_ip_from 0.0.0.0/0 could be troublesome in the future. Basically nginx trust all internet host for given the real IP Address via X-Forwarded-For header, even from spoofed request. For example (credit to this ...


2

Assuming you still have only one database, the most important question to ask is, how much will the remote webserver depend on the database? If everything the webserver does will depend on communicating with a database in another location, then you will have increased exposure in case of network problems. If you have pages needing multiple database queries, ...


4

Based on the details that your provided, I don't think there is enough information to say it is a good idea or not. It depends if the application is used by multiple countries or not plus other factors such as latency sensitiveness. Load balancing between 2 data centers might be a little more complex and expensive than Load balancing in the same data center. ...


0

Nerijus is right, this issue is caused by the HAProxy having a client timeout, which means, if the connection is considered idle for more than X ms then the connection is dropped. TCP can send keep-alive packets to ensure an idle connection should stay open. You can check your TCP parameter for keep-alive packets using the following command: $ cat ...


1

Two haproxy instances can share load by using 2 virtual IPs with each instance the master for one of those. Round robin DNS roughly balances between the 2 virtual IPs (and consequently between the two haproxy instances). This method also works with SSL. One reason to think twice about this active-active setup though is if one instance can't cope with the ...


1

If the Redundancy State Preference setting is "None", then neither cluster member will forcibly take over as the active unit. That is, whichever unit happens to be active will remain active. Alternatively stated, whichever unit completed the boot process first would be active (since it saw that its partner was down), and the second unit to finish booting ...


0

The error message peer holds all free leases can also mean that the request has been received on the wrong network interface, e.g. if a computer is only configured to get an IP on eth0, but the DHCP request is received on eth1. deny dynamic bootp clients is typical for such a setup. In my case one interface was for the workstation network and the other one ...


2

I'd suggest using a different solution like haproxy, an nginx proxy, or nearly any other actual load balancing method. Usually iptables load balancing is used for outgoing packets on multiple uplinks. If you must balance using iptables, then you need to use a different method. Just every few packets will mangle all your requests. I saw a decent tutorial on ...


2

I had the same problem as @tom-angelo-clemente, but solved it by using the broadcast address on the bind parameter of a frontend: frontend wfe bind 0.0.0.0:80 This will bind the proxy to any IP address the machine is using (not sure about addresses on different NIC devices), so be careful when using this way if you have a private management interface ...


1

Yes, CloudFlares load balancers are more than enough to load balance your traffic. However as the comments above stated this opens up some issues that you have to be willing to deal with. 1) CloudFlares load balancers do not perform sticky sessions. This means anyone that goes to you site may land on one server for one request and another for another ...


0

I had problem where telnet 127.0.0.1 9200 gave 503 Server unavailable response, but when I executed /usr/bin/clustercheck as root it showed that everything was fine. With this command I was able to execute clustercheck as user nobody and got real MySQL error to /tmp/cluster.log: sudo -H -u nobody bash -c "/usr/bin/clustercheck clustercheckuser ...


1

TTL or Time To Live is the interval that DNS will be cached. So yes. it takes 5 minutes for them to get redirected (as maximum if the client doesn't use the authoritative DNS server from Azure).


0

First: Please don't delete your localhost.crt. If you do, you wont be able to re-start your server and your web page will be offline. If by any chance you do, you have to re-generate a new localhost.crt file from your private key using the following command: openssl req -new -x509 -nodes -sha1 -days 365 -key /etc/pki/tls/private/localhost.key > ...


0

The command is looking for a file that does not exist file does not exist: /var/www/html/certificate.pem Possibly your certificate is not named certificate.pem, or my guess is you don't have a folder named /var/www on your local system where you're running this command (nor on your mac). You need to put the location of certificate.pem on your local ...


0

As mentioned by others phpMyAdmin should not be used in production, but I'll answer my own question anyway. To get this working I had only to specify my virtual host and server name for Apache: <VirtualHost 127.0.0.1> ServerName www.example.com


0

If you really need real-time replication of all the files uploaded, you need a distributed file system like GlusterFS or use a DRBD/ocfs2 setup. Otherwise I would go with csync2 or a simple rsync script.


0

I found a solution, of sorts. It seems that ip_hash is incompatible with the backup directive, and possibly with any other directive in the upstream block. Once I removed the backup line, ip_hash works as it should. However, this seems strange. I'm using a recent version of NGINX - 1.6 - and I can't find anything in the more recent docs to say that ...


2

The hostname used in the SubjectCN (optional, but common) and at least one entry in the SubjectAN (mandatory) needs to match the name by which you reference the VirtualHost (whether you gen the VirtualHost by Name (using SNI) or by IP). Additionally, you should have this hostname genned as either the main hostname or an alias in your /etc/hosts. Note, this ...


0

when using lvs with ssl, set the certificates on the ssl service servers (ldap in my case) to match the load-balancer VIP, not the hosting server DNS names. This means that when you hit the lvs server VIP:ssl port, the cert negotiation matchs the reverse dns name that is expected by the initiating server. Testing ssl handshake -> openssl s_client -connect ...


1

Thanks to a comment by @ShaneMadden I was able to figure this out. This issue is that I need both VirtualHosts to specific the same IP using a wildcard. So my configuration needs to look like this: <VirtualHost *:443> # here i specify the certificate for 185.185.185.185, e.g. SSLCertificateFile /etc/ssl/private/185.185.185.185.crt ServerName ...


0

iptables has a statistic module, which could be used. It can operate in two modes which are either randomized or deterministic. Here is how your rules could be written with that module. Deterministic version: -A POSTROUTING -s 10.8.0.0/24 -m statistic --mode nth --every 5 --packet 0 -j SNAT --to-source 192.0.2.1 -A POSTROUTING -s 10.8.0.0/24 -m statistic ...


0

To be clear, this is not load-balancing. Load balancing would balance the load over multiple hosts. You're only spreading the source address across multiple IP's on the same host. It's not going to give you any performance benefits, but make your set up more complicated. But, assuming you want to go ahead. According to iptables-extensions man page. ...


1

You have add balancer-manager handler in same virtualhost where you have configured load balancer. Also need you need to exclude location with "ProxyPass /balancer-manager !". Please see the below virtualhost <Virtualhost x.x.x.x:443> SSLEngine On ServerName abc.xyz.com ..... <Location /balancer-manager> SetHandler balancer-manager ...


1

One of the benefits of ARR as of Nov 2014, is the it provides client affinity to your HTTP requests. As of now, the Azure load balancer / traffic manager does not provide this.


0

Set a ProxyTimeout to just a few seconds - what's happening is that it's sitting there trying connections to the down backend for a long while, not timing out. Setting something like ProxyTimeout 3 will cause the connection to fail more quickly, then your retry=60 setting will cause the down server to not be used again for the next minute.


2

You can create an ACL iRule, documentation here: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-datacenter-firewall-config-11-1-0/5.html The list of allowed IPs may be separated to an object called a data group and then used in the iRule.



Top 50 recent answers are included