Tunneling ports through different routes without the knowing of the local programs

Question

I need to set up the following scheme:

• server1: Generic program connects locally to proxy, which then connects to proxy to server2.
• Everything is ok, until the connection between the servers.

• When the connection is down OR some other event occurs (for example packet loss, many retransmits and so on) Things won't work and we need to do the following:

  1. server1 to "reroute" the current connection to a third server(server3) with the same proxy program
  2. server3's connection to server2 is OK,
  3. so as a result a local generic program does not reconnect or even care about the connectivity issues.
  4. respectively the local generic program on the other side (on server2) also does not know that there is another route.

Probably, this can be simulated with haproxy and openvpn, but the openvpn connect is too slow for fast switches, and the setup is too complicated for just one service (let's say tcp port).

[-It's like the tunneling of a port-] and the local client program on server1 does not need to reconnect (or make a new connection) to the server program on server2, when something happen between server1 and server2

Can anyone advice me for such tcp-proxy-reroute program under linux?

Edit: I did not mean that I need to save the tcp session or so.

I need something like haproxy (working on layer 7),

• when client_prog_1_srv_1 connects localhost haproxy_1_srv_1,

• haproxy_1_srv_1 connects (Internet) to haproxy_2_srv_2,

• haproxy_2_srv_2 connects to server_prog_2_srv_2 (binds and connects locally, too),

• but when there is no connection between haproxy_1_srv_1 and haproxy_2_srv_2,

  • haproxy_1_srv_1 to connect to haproxy_3_srv_3,
  • which connects to haproxy_2_srv_2 and reuse the opened connection between haproxy_2_srv_2 and server_prog_2_srv_2.
  • Connections between haproxes are through internet, connections to the end program (client,server) are always local.

---

Answer 1

It is not possible to build a proxy like this with TCP if the outgoing IPs are different on servers 2 and 3.

It may be possible if you have control of your routes and can use route metrics, OSPF or similar to automatically route packets around bad connections, if there is no NAT involved. If there is NAT involved, there are probably less complex solutions, for example, teaching your client to reconnect on error.

If it really must be designed like this, you may be able to use anycast or failover to allow both servers 2 and 3 to have the same outgoing IP, but without more detail, your usage case doesn't sound like something where you'd have that capability.

Answer 2

Here's the thing about arbitrary or generic linux programs... They have no character[istics]...

You want application level [layer 7] networking but on a generic program/protocol. https://www.rfc-editor.org/rfc/rfc3768 (RFC 3768 -

Add on LVS and suddenly you are back are essentially sitting on HAProxy. In order to do it at layer seven you will have to write your own wrapper server to:

1. accept all connections on the front end
2. Monitor the list of available server/routes on the backend
3. direct traffic through an active server/route

You question is... complex... But I believe that is because you are making many assumptions. A VPN is likely a good way to complicate this to a point that you will never get it to work. If you tell us EXACTLY what you need to do, we might be able to help steer you in the correct direction.

Answer 3

It can be done with the following setup:

1. private network with openvpn+haproxy(in tcp mode) on the two edge servers and only haproxies on the middle servers.
2. each openvpn is connecting locally to a haproxy with config:"one normal server and one backup server", a check is done by the haproxy to verify, which server should be used.
3. the check shows haproxy must use the backup, so haproxy switches the connection to a middle server. The connection is torn down.
4. an immediate openvpn reconnect occurs - but this time tcp connection is going to be "routed" from the edge-haproxy->backup link to the middle-haproxy, which in turn proxy to the second edge-haproxy, with which the second edge openvpn is reached. Note openvpn does not know there three haproxies along the route.
5. the private addresses, which is on the other side is not available for a while, so a time out occurs between the established connections of the applications on the both sides.
6. the openvpn builds the connection again, the private network is up again, all private address are available, applications on both side can recover from a time out.
7. No reconnects are made on the layer 7 applications on both sides. Lost some packets, which triggers some retransmits on the tunnelled network for a while, but in the end everything is ok.

Have you ever used a vpn? You connect your computer to the vpn server, then you are in your corporate private network, then you use ssh to your work computer, if Internet connection drops for a minute, the vpn tries to reconnect, but the ssh is retransmitting during the time out period. The Internet connectivity is up after a minute, the vpn builds the tunnel again, the ssh continues, without the need of reconnect (eventually retransmits are successful, before a time out occurs). That's the effect I need, but tunnel must pass a middle server, because it has a better connectivity for a while. It can be done if all the tcp traffic is carried out by haproxies talking each other. But I think this setup is very complicated and the openvpn (or the tunnels) are slow in reconnects. Note haproxy is this application - http://haproxy.1wt.eu/ , which has a tcp mode - a very similar in term of functionality to the http proxy.