I have IPVS configured as:

$ ipvsadm --save
-A -t localhost:<port> -s rr
-a -t localhost:<port> -r <other_hostname>:<port> -m -w 1

It seems to be running:

$ ipvsadm
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  localhost:<port> rr
  -> <other_hostname>:<port>         Masq    1      1          0

but that 1 'ActiveConn' hangs indefinitely, while a direct request responds quickly and as expected:

$ curl https://<other_hostname>:<port>
$ curl https://localhost:<port>

Nothing seems wrong in dmesg:

$ dmesg | grep IPVS
[ 4795.060820] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 4795.060932] IPVS: Connection hash table configured (size=4096, memory=64Kbytes)
[ 4795.061202] IPVS: ipvs loaded.
[ 4795.067663] IPVS: [rr] scheduler registered.

And nothing in journalctl from ipvsadm.

It seems to get stuck in state SYN_RECV:

$ ipvsadm -lnc
IPVS connection entries
pro expire state       source             virtual            destination
TCP 00:56  SYN_RECV<port>   <other_ip>:<port>

It seems that it isn't a configuration issue with the real server, since it's an issue with all modes (route, masquerade, tunnel) and testing with httpbin.org rather than my own.

What can cause a request to an IPVS to hang or fail when the 'real server'(s) underlying it respond OK, and how can it be debugged?

  • I initially asked on SO, but got a close vote suggesting it's a better fit here. stackoverflow.com/questions/58040533/… – OJFord Sep 21 at 16:25
  • It's a firewalling or networking issue. Debugging will be via tcpdump. – womble Sep 23 at 1:12
  • @womble firewalling that affects ipvs but not 'direct' requests? The target IP address doesn't appear in tcpdump at all. – OJFord Sep 25 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.