1

There are two servers with the same VIP, and when one server curls another server, the reply packet (which has src addr same as lo addr) seems to be dropped by the request server. How can I allow it?

edit: only on ipv4, ipv6 work, rp_filter off, forward on

Context: I have an ipvs LB that also acts as a router that connects to a server over layer 3. When I curl with VIP less from the LB, everything works fine. But with a VIP on lo, the reply packet from the server seems to drop, I put a trace in iptables where it only shows raw:PREROUTING:policy (with the default accept).

May 25 22:31:02 kernel: [170321.010523] TRACE: raw:PREROUTING:policy:4 IN=interface OUT= MAC= SRC=172.20.222.30 DST=172.20.222.9 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=443 DPT=40487 SEQ=1050428198 ACK=2154353852 WINDOW=62076 RES=0x00 ACK SYN URGP=0 OPT (020422B00402080AF5EE4941A68D3D5A01030307)

Improve this question

1 Answer 1

Reset to default
1

I found that the kernel parameters accept_local solve the problem. In the newer kernel accept_local won't depend on the value of rp_filter

net.ipv4.conf.default.accept_local = 1
net.ipv4.conf.all.accept_local = 1

accept_local - BOOLEAN Accept packets with local source addresses. In combination with suitable routing, this can be used to direct packets between two local interfaces over the wire and have them accepted properly. default FALSE

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .