I have been testing keepalived and preparing to roll out on my vps.

My setup is:

2: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel  state UP group default qlen 1000
    link/ether ab:cd:ef:ab:cd:ef brd ff:ff:ff:ff:ff:ff
    inet xxx.xxx.xxx.xxx/24 brd xxx.xxx.xxx.xxx scope global ens4
       valid_lft forever preferred_lft forever
    inet scope global ens4:1
       valid_lft forever preferred_lft forever
    inet scope global secondary ens4:2
       valid_lft forever preferred_lft forever is the private IP address "looking" into private network (assigned by my hosting provider) is the floating IP, also on private network (assigned by my hosting provider)

I have a separate host,, which I would like to route traffic through my floating IP. So on keepalived, when host is becoming master, I am adding those routes:

ip route add via dev ens4 src
ip route add via dev ens4 src

And everything works great, when I ping and running tcp dump on that host I can see traffic is being routed correctly.

My problem is that I'm running postgresql on that host with floating IP which I would like to be only available through (not even through And it works great as long as database is accessed from the outside. When I try to make connection from via I get an error:

FATAL:  no pg_hba.conf entry for host "", user "postgres", database "postgres", SSL off

This tells me that my routing is not working when exercising it from the keepalived host itself.

I'm wondering how do I modify my routing so traffic goes through even when originating from that same host.

  • I can't quite make sense of your question. What precisely do you mean by "available through"? Apr 27 '17 at 4:25

You have access deny error which means that the routing works well.

Routing doesn't change source or destination ip addresses in ip packets. Use firewall to disallow access to postgres database on ip address. When postgress client connect to your server's ip address it use first ip address on server's interface. This address doesn't allowed in pg_hba.conf config file.

Also this network scenario isn't good because postgres and other software will answer from first ip address (which are in one network) on ens4 interface.

You don't need to add such routing rules, because all ip address in them are in one network

  • This is what question is about, I don't want this traffic to come through the interface alias it came through. If you read the question you will notice, I want the traffic to come through, not
    – Greg0ry
    Apr 26 '17 at 8:32
  • Use one ip address on interface and firewall to allow or disallow access to your server. Apr 26 '17 at 8:52
  • If you read my question you will notice I have three aliases due to my VPS provider. One for public connections, one for private inter-VPS connections and one which is a floating IP. This is not something I have control to change.
    – Greg0ry
    Apr 26 '17 at 9:52
  • All software will connect to services in network with source ip because it's first ip address in this network on server's interface. Routing doesn't help you. Apr 26 '17 at 15:53
  • 1
    @Greg0ry It will send traffic out on the interface that has the route to the next hop. Are you saying it's not doing that? Apr 27 '17 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.