0

I have been testing keepalived and preparing to roll out on my vps.

My setup is:

(...)
2: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel  state UP group default qlen 1000
    link/ether ab:cd:ef:ab:cd:ef brd ff:ff:ff:ff:ff:ff
    inet xxx.xxx.xxx.xxx/24 brd xxx.xxx.xxx.xxx scope global ens4
       valid_lft forever preferred_lft forever
    inet 192.168.1.2/24 scope global ens4:1
       valid_lft forever preferred_lft forever
    inet 192.168.1.3/24 scope global secondary ens4:2
       valid_lft forever preferred_lft forever

192.168.1.2 is the private IP address "looking" into private network (assigned by my hosting provider) 192.168.1.3 is the floating IP, also on private network (assigned by my hosting provider)

I have a separate host, 192.168.1.99, which I would like to route traffic through my floating IP. So on keepalived, when host is becoming master, I am adding those routes:

ip route add 192.168.1.3/32 via 192.168.1.3 dev ens4 src 192.168.1.3
ip route add 192.168.1.99/32 via 192.168.1.3 dev ens4 src 192.168.1.3

And everything works great, when I ping 192.168.1.99 and running tcp dump on that host I can see traffic is being routed correctly.

My problem is that I'm running postgresql on that host with floating IP which I would like to be only available through 192.168.1.3 (not even through 127.0.0.1). And it works great as long as database is accessed from the outside. When I try to make connection from 192.168.1.3 via 192.168.1.3 I get an error:

FATAL:  no pg_hba.conf entry for host "192.168.1.2", user "postgres", database "postgres", SSL off

This tells me that my routing is not working when exercising it from the keepalived host itself.

I'm wondering how do I modify my routing so traffic goes through 192.168.1.3 even when originating from that same host.

1
  • I can't quite make sense of your question. What precisely do you mean by "available through 192.168.1.3"? Apr 27 '17 at 4:25
1

You have access deny error which means that the routing works well.

Routing doesn't change source or destination ip addresses in ip packets. Use firewall to disallow access to postgres database on 192.168.1.2 ip address. When postgress client connect to your server's 192.168.1.3 ip address it use first ip address 192.168.1.2 on server's interface. This address doesn't allowed in pg_hba.conf config file.

Also this network scenario isn't good because postgres and other software will answer from first ip address (which are in one network) on ens4 interface.

You don't need to add such routing rules, because all ip address in them are in one network 192.168.1.0/24.

17
  • This is what question is about, I don't want this traffic to come through the interface alias it came through. If you read the question you will notice, I want the traffic to come through 192.168.1.3, not 192.168.1.2.
    – Greg0ry
    Apr 26 '17 at 8:32
  • Use one ip address on interface and firewall to allow or disallow access to your server. Apr 26 '17 at 8:52
  • If you read my question you will notice I have three aliases due to my VPS provider. One for public connections, one for private inter-VPS connections and one which is a floating IP. This is not something I have control to change.
    – Greg0ry
    Apr 26 '17 at 9:52
  • All software will connect to services in 192.168.1.0/24 network with source ip 192.168.1.2 because it's first ip address in this network on server's interface. Routing doesn't help you. Apr 26 '17 at 15:53
  • 1
    @Greg0ry It will send traffic out on the interface that has the route to the next hop. Are you saying it's not doing that? Apr 27 '17 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.