0

I'm trying to setup my 2-gateway configuration with loadbalacing with IP_VS kernel module.

I need to loadbalance forwarding traffic to 2 nodes. I do:

  1. Setup ip_vs fwmark service and add 2nodes.

  2. On each node setup network firewall rules to set FWMARK to traffic with DestAddr != node_ip;

But lvs_service not detecting marked traffic and not loadbalance.

Can anyone help with proper configuration? Here is desired config/topology diagram: enter image description here

Diamond
  • 9,001
  • 3
  • 24
  • 38
Dcow
  • 59
  • 3

1 Answers1

1

What you are doing is not what IP_VS is intended to be used for. I think you are better off forgetting about IP_VS altogether and use a different approach.

You mention VRRP in your diagram. That is a more sensible approach to your problem. However notice that VRRP by itself is for redundancy not load-balancing. Simply using VRRP without any other means of load-balancing will have all your clients use a single router until that router fails and all clients move to the other router.

You can load-balance the clients across the routers without using VRRP at all. You can simply hand out two different gateway IP addresses to the clients.

That very basic approach to load-balancing doesn't allow you to easily re-balance the traffic, and it doesn't provide fail-over. Through DHCP you can tell a client machine which of the two routers to use, but it will keep using that router, even if that router turns out to become overloaded. You can only shift traffic between the routers when clients disconnect and reconnect to the network.

Instead of handing out the two IP addresses assigned to the physical interfaces as gateway addresses, you can hand out a pool of virtual IP addresses to the clients. The more gateway addresses you use, the more fine-grained you can shift traffic between the routers.

For instance you can allocate 10 different gateway addresses and have each router be primary for 5 gateway addresses. Through DHCP you balance the clients across the 10 gateway addresses, and VRRP can allow each address to fail over independently between the two routers.

There is another caveat if any NAT is involved. If both gateways are doing NAT, then failing over a gateway IP between the gateways will cause all clients using that gateway IP to get their established connections broken. Solving this is the most challenging part of the setup. The good news is, that as long as you rarely fail over a gateway IP between the gateways, it isn't going to be a major problem for the users.

You can do better if each router will realize when a packet received from the LAN belongs to a connection NATed by the other router and forward that packet across a link between the two routers. It should only be a minor amount of traffic which gets forwarded across that link, and the majority of the traffic sent to the gateway IP that you just failed over to the other router will indeed go across the WAN connection on the same router which the client sent it to.

kasperd
  • 30,455
  • 17
  • 76
  • 124