Dear all. I have the following trouble: Using carp and pfsync i have made the redundand firewall (OS is 6.1p2 and everything is done like in mans, even ifconfig options) The only thing that is different that i have 2 ethernet interface (one for crosover link and the other is the paren interface for vlans) host1 ifconfig_vlan101="inet X.Y.Z.1 netmask 255.255.255.0 broadcast X.Y.Z.255 vlan 101 vlandev em0" ifconfig_carp0="vhid 1 pass abc X.Y.Z.3" ifconfig_vlan100="inet A.B.C.1 netmask 255.255.255.0 broadcast A.B.C.255 vlan 100 vlandev em0" ifconfig_carp1="vhid 1 pass abc A.B.C.3" ifconfig_pfsync0="up syncif em1" host2 ifconfig_vlan101="inet X.Y.Z.2 netmask 255.255.255.0 broadcast X.Y.Z.255 vlan 101 vlandev em0" ifconfig_carp0="vhid 1 advskew 100 pass abc X.Y.Z.3" ifconfig_vlan100="inet A.B.C.2 netmask 255.255.255.0 broadcast A.B.C.255 vlan 100 vlandev em0" ifconfig_carp0="vhid 1 advskew 100 pass abc A.B.C.3" ifconfig_pfsync0="up syncif em1" What i have is that when i'm pinging carp0 (inet) or carp1(lan) interface's ip address of my firewall - i'm receivind DUP responses. And when host2 is ths slave and i'm starting to ping carp0 address - no traffic appears on master host - that means that the local carp interface responding to my packets.. That means that in case some service (provided by jail managed by freevrrpd) will be accessed from outside - i cannot be sure what host will answer the request. I have done some tests. When i'm sshing to virtual IP - sometimes i'm getting ssh prompt and can login, and sometimes it says that host auth info is bad (yes, because second server answering me at this time) and sometimes i'm loosing ssh connection while session is active. net.inet.carp.preempt = 1 net.inet.carp.log=2 net.inet.carp.arpbalance=0 No ballance needed. I want to have some service run in main OS, some services run in jail and i want to be sure which host will answer the request when bouth hosts are up and running. Could please someone direct me what to do or where to read? Best regards, Anton Nikiforov
On Thursday 06 July 2006 22:46, Anton Nikiforov wrote:> Dear all.[snip]> > That means that in case some service (provided by jail managed by > freevrrpd) will be accessed from outside - i cannot be sure what host > will answer the request. >You have vrrp on jails and carp on the host system? That's probably not a good idea, they both use the same ether-type. Who is gonna get the incoming packet? carp or freevrrpd? both? I guess both. Who is gonna reply? Do you know if a vrrp packet confuses carp or conversely? nik:0:~$ grep carp /etc/protocols carp 112 CARP vrrp # Common Address Redundancy Protocol
Hi! First of all. If you're using carp, you need ports/net/ifstated, not freevrrpd. On Thu, Jul 06, 2006 at 11:46:18PM +0400, Anton Nikiforov wrote:> What i have is that when i'm pinging carp0 (inet) or carp1(lan) > interface's ip address of my firewall - i'm receivind DUP responses.One from carp and other from freevrrpd.> And when host2 is ths slave and i'm starting to ping carp0 address - > no traffic appears on master host - that means that the local carp > interface responding to my packets..Yep. Full standby mode (backup don't have shared IP) is not implemented now.> That means that in case some service (provided by jail managed by > freevrrpd) will be accessed from outside - i cannot be sure what > host will answer the request.I don't understand your idea. Do you want to start-stop jail, when master node is down-up?> I have done some tests. When i'm sshing to virtual IP - sometimes > i'm getting ssh prompt and can login, and sometimes it says that > host auth info is bad (yes, because second server answering me at > this time) and sometimes i'm loosing ssh connection while session is > active.Use 'advbase' and 'advskew' params on both hosts for hard managing status of nodes.> No ballance needed. I want to have some service run in main OS, some > services run in jail and i want to be sure which host will answer > the request when bouth hosts are up and running.Be careful, if you want to use carp IP inside jail. Only master node can get data from external world. I tried to make this schema: ldap1 / \ ldapn1 ldapn2 | | | | | | clients clients Where ldap1 -- master ldap server. ldapn1, ldapn2 -- jail on different hosts on carp shared IP. They connect to ldap1 and get fresh data from master ldap server. I found, that only master node can start successfully. Jail on backup node can't start, because ldap server can't start. It can't start, because, it can't successfully connect to ldap1. ldapn2 sends SYN, ldap1 returns SYN+ACK, and switch delivers this packet to ldapn1 -- active master node. In order to have this schema working, both nodes must have personal IP and shared IP, but it's impossible within current jail implementation. WBR -- Dmitriy Kirhlarov OILspace, 26 Leninskaya sloboda, bld. 2, 2nd floor, 115280 Moscow, Russia P:+7 495 105 7247 ext.203 F:+7 495 105 7246 E:DmitriyKirhlarov@oilspace.com OILspace - The resource enriched - www.oilspace.com