5

I am currently trying to find a way to Load Balance our 4 Mail Gateways ( Running Mail Cleaner). I was able to bring up HAProxy and use tcp mode to load balance without issue. The only real problem being my Source IP is always the HAProxy server, so some of my mail filter checks are useless now because I can not check if the mail is coming from a known bad relay.

Is their any FLOSS Software out that could be used to handle this type of situation? I know HAProxy has this ability if I have the Mail Gateways use it as the Default Gateway, and compile some additional modules and configure iptables. I just dont want to start down that path if I am just missing an easier solution.

Improve this question

2 Answers 2

Reset to default
2

We do this simply using Linux Virtual Server, which is part of the standard linux kernel for some years now.

It allows for weigth-based loadbalancing and is quite easy to setup, we are doing something like this:

ipvsadm -A -t 192.168.0.3:25 -s wrr
ipvsadm -a -t 192.168.0.3:25 -r 192.168.0.8:25 -g -w 100
ipvsadm -a -t 192.168.0.3:25 -r 192.168.0.9:25 -g -w 100

(where 192.168.0.3 is your "service IP" or "virtual IP" and 192.168.0.8 and 192.168.0.9 are your "real servers")

Most important to know - the way of operation. This setup uses "gateway mode", in which source and destination of the packets are not changed. But this has some implications. The virtual ip has to be configured on all "real servers". But this might lead to ARP race conditions you should avoid by design:

  • Either your "real servers" are behind the load balancer in a separate LAN
  • OR you configure your real servers not to reply to ARP for the virtual address
  • OR you are routing the virtual IP directly to your load balancer so it is not ARPed for

Perhaps -m - masquerading mode is a little bit easier to set up.

And - another hint here: you might want to use keepalived which sets ipvsadm up, monitors your mail server for reachabilty and perhaps provides redundancy for the loadbalancer itself using VRRP.

We are using ipvs to handle 15k CPS DNS load balancing.

(*) at least in debian it's called this way, but searching for ipvs should be easy

Improve this answer
3
  • This is exactly what I was after. Thank you very much!
    – Justin S
    May 8, 2012 at 14:54
  • +1 I wasn't aware of this solution, good information. That may work, but it adds additional complexity and failure modes. Whereas MX records and DNS is rather simple and effective and "just works". I think it would be overkill unless your site gets so much email traffic that just using MX records and DNS and having multiple MTAs of equal priority is just not going to work.
    – aseq
    May 8, 2012 at 19:48
  • @aseq: Thanks. And total agreement to your argumentation! It gives finer control at a quite higher cost...
    – Michuelnik
    May 9, 2012 at 12:54
5

SMTP has built in load balancing using DNS, in a round robin fashion. This works quite well for most purposes. If that's not sufficient for you, you will have to create your own custom set up which is not an easy task. So unless you really need it I'd stick with what is available and widely used.

I am assuming your email servers (MTA) are on the same domain (say example.org), in that case create an MX record for each separate MTA, with the same priority. Using same priority ensures each server is tried in a round robin fashion, otherwise the one with the highest priority (lower number) is always tried first (in the case of MTAs that aren't broken, spammers love to hit the server with lowest priority thinking it may be a lower spec "fallback" server):

example.org.    IN  MX  10  mx1.example.org.
example.org.    IN  MX  10  mx2.example.org.
example.org.    IN  MX  10  mx3.example.org.
example.org.    IN  MX  10  mx4.example.org.

Of course make sure each mx* can be resolved:

example.org.    IN      A       192.168.2.1
mx1     IN      A       192.168.2.2
mx2     IN      A       192.168.2.3
mx3     IN      A       192.168.2.4
mx4     IN      A       192.168.2.5

If you want to also use DNS to "load balance" MTAs for your users to send out email you can configure DNS in this way. Let's call your outgoing server smtp.example.org and tell your users to submit email to it. I put "load balance" in quotes because this won't avoid connecting to a server that's down the way MTAs deal with it using MX records. In this case the user has to retry one or more times to hit a working server. 

smtp    IN      A       192.168.2.2
smtp    IN      A       192.168.2.3
smtp    IN      A       192.168.2.4
smtp    IN      A       192.168.2.5

This is a crude solution because depending on the user's system and setup they may keep trying to hit just one IP. But at least it's not "down for everyone" and you can always direct them to a working server. In addition if a server is permanently down you can remove it from the DNS and once cached that should prevent your users from hitting it. In this case haproxy may not be such a bad solution.

Improve this answer
2
  • Thanks for the reply. Our current setups mirrors your above post, I would really like to be able to truly balance the load based on usage and weight. DNS just wont satisfy the requirement.
    – Justin S
    May 8, 2012 at 1:54
  • MTAs are very capable handling a large throughput and MX records provide a helpful cheap way to balance load and create redundancy. I think you'll find that if you focus more on the backside of things (improved i/o speed for queue handling for example) things can improve greatly. Big sites have implemented their own email load balancing and there may be a few commercial offerings available, but I doubt the cost is warranted unless you have a load like one of those big sites. Besides any slapped together solution will likely prove to be more of a pain than an actual solution.
    – aseq
    May 8, 2012 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .