On Thu, Dec 24, 2009 at 01:33:02PM +0100, XANi wrote: > There is also little iptables hack, if u wanna be 100% sure no client > will get rejected when you're restarting, block sending TCP RST packets > to client, so when TCP SYN hits loadbalancer when its restarting and > frontend port is closed, client connection won't get resetted, TCP will > just retransmit SYN packet.
Yes. With recent kernels, another possibility might be to use the socket match to accept incoming packets only for bound sockets. In general you should avoid blocking outgoing RST packets for a long time because they're quite needed to reset out of sync sessions. But that's fine during the restart though. Willy
