Hello! I have set-up four nodes system: two LVS load balancers (CentOS) and two working nodes (openSUSE). LVS nodes have global IPs, so they able to access the internet and working nodes have only private IPs, so they cannot access internet directly. I use NAT-base load balancing.
Now I need to know how give working nodes ability to access the internet? I ask this because I don't know how to write properly iptables rules so LVS balancing packets will not conflict with working nodes internet connections. Should I assign some IP-alias for default gateway for that nodes or something else?
Thanks.
Igor Zhbanov wrote:
Hello! I have set-up four nodes system: two LVS load balancers (CentOS) and two working nodes (openSUSE). LVS nodes have global IPs, so they able to access the internet and working nodes have only private IPs, so they cannot access internet directly. I use NAT-base load balancing.
Now I need to know how give working nodes ability to access the internet? I ask this because I don't know how to write properly iptables rules so LVS balancing packets will not conflict with working nodes internet connections. Should I assign some IP-alias for default gateway for that nodes or something else?
You should read thru the LVS HowTo, more about LVS-NAT. There is no reason why your LVS load balancers can't also act as general NAT gateways, that's really what they're already doing. Just make sure your LVS-NAT gateways are masquerading internally initiated outbound traffic. I don't think you'll have a problem.
Jed
Now I need to know how give working nodes ability to access the internet? I ask this because I don't know how to write properly iptables rules so LVS balancing packets will not conflict with working nodes internet connections. Should I assign some IP-alias for default gateway for that nodes or something else?
make sure you can route the outbound traffic through the lvs cluster and then nat it to the external pool IP of that cluster
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s some_internal_IP -o eth0 -j SNAT --to-source the_public_cluster_IP
you can add as many of the second lines as you see fit depending on how many internal boxes you have.
Also remember that the default route for the internal boxes should be an IP that is floating so that in the event of one of your LVS's crashing you can still route outbound.
Hope that helps
-
Igor Zhbanov -
Jed Reynolds -
Tom Brown