[CentOS] conntrack-tools and Session syncing

Sun Aug 10 18:28:31 UTC 2008
Dirk H. Schulz <dirk.schulz at kinzesberg.de>

Hi Robert,

--On 10. August 2008 13:56:22 -0400 Robert Spangler 
<mlists at zoominternet.net> wrote:

- snip -

> OK, I don't know this tool you are using to syn the conntracking of all
> the  firewalls.  Could you post a link to it?

Yes, of course: 

> Now for the fun stuff.  Why would you have many Internet connection that
> do  not return the same path they go out on?  sounds like you really only
> have  one true connection with one true IP to the Internet.  That would
> explain why  traffic leaving on interface 2 comes back on interface 1.

It is two routers that are connected to 2 upstream routers; all four use 
OSPFv2 for routing between them.
I have not finetuned OSPF so far to avoid asynchronous routing - I want to 
to do the connection table synchronization stuff before because I have to 
do it anyway (in case of a router crash) and now I have an ideal testbed 
(because of the asynchronous routing).

> Without knowing your setup I'm not going to guess at this.

The setup is as follows: Every Router has
- an external interface with public ip address each resting in a small 
separate subnet that connects to the upstream router
- an interface for inter router connections (private ip addresses)
- 2 additional interfaces to server LANs - both routers have an interface 
to both of the 2 server LANs
	both server LAN interface use shared virtual ips additionally

If you need more detailed information I could offer the OSFP configuration 

Here is the configuration for conntrackd (I have omitted buffer sizes 
> Sync {
> 	Mode FTFW {
> 		ResendBufferSize 262144
> 		CommitTimeout 180
> 		ACKWindowSize 20
> 	}
> 	Multicast {
> 		IPv4_address
>		IPv4_interface
> 		Interface eth1
> 		Group 3780
> 	}
> 	Checksum on
> 	CacheWriteThrough On
> }
> General {
> 	HashSize 8192
> 	HashLimit 65535
- snip -
> IgnoreTrafficFor {
> }
> IgnoreProtocol {
> }

The setup works - using "conntrackd -e" I can see the connection table 
entries the other router's conntrackd has synchronized. What I cannot check 
is if the receiving conntrackd writes the received entries into the kernels 
connection tracking table.
> udp      17 30 src= dst= sport=2040 dport=1434 
[UNREPLIED] [active since 6s]
> tcp      6 120 SYN_SENT src= dst= sport=4290 
dport=135 [UNREPLIED] [active since 46s]

So I hope to find someone on the list have done this kind of setup before.

Thanks for your interest so far.