Hi Timothy, I've been watching this post to see if you get any replies, I too recently had issues trying LVS-TUN in Amazon AWS... I was using an IPsec VPN from home to my VPC attempting to load balance servers across this link. Later, I tried as a sanity check against my own(Proxmox) hosted server(In a local DC) using an OpenVPN link which I also couldn't get to work... Although it works in the LAN with Linux boxes as my routers when I try to simulate the network layout without VPN's...
Other pressures eventually pulled me away from this task but I had planned to go back to it at a later date so on seeing your post I've been eagerly awaiting any replies you might get. I have nothing to really offer at this stage as a resolution but wanted to give the topic a bump at least, however, if I learn anything on my next round of testing I'll share it. >From my troubleshooting I think I proved that the traffic got as far as the tunnel adapter on the real server but seemed to get lost on the return path, I believe it's only the part between director and real server that uses a tunnel with replies going directly back to the client like DR mode so I was assuming(Maybe incorrectly) that something was dropping them on the path back. Aaron West Loadbalancer.org www.loadbalancer.org +1 888 867 9504 / +44 (0)330 380 1064 aa...@loadbalancer.org LEAVE A REVIEW | DEPLOYMENT GUIDES | BLOG On 14 July 2017 at 16:13, Timothy R. Weiand <timothy.wei...@gmail.com> wrote: > I am building a DR-TUN configuration to load balance DNS traffic. My issue > is with the real servers: the ipip packet get unwrapped and appears on the > tunnel interface and becomes a martian. Also, I have not been able to > determine how to bind to the tunnel interface to capture these packets. I > have verified details with tcpdump/dmesg. All my configuration is scripted > to ensure reproducibility. tcpdumps below do not show real DNS traffic; > using netcat to send text. > > Much more detail can be supplied, please request it. > > Configuration: > > ============== > > - All machines are currently Debian 9 (4.9.30-2+deb9u2) > > - Client: 192.168.200.10 > > - Director: 192.168.200.11 > > - Real Server: 192.168.200.12 > > - No VIP: I am using the IP address for my director interface - > 192.168.200.11 > > > Director Configuration: > > ================== > > vagrant@debian-9-lb:~$ sudo ipvsadm -Ln > > IP Virtual Server version 1.2.1 (size=4096) > > Prot LocalAddress:Port Scheduler Flags > > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > UDP 192.168.200.11:53 rr > > -> 192.168.200.12:53 Tunnel 1 0 0 > > > > Real Server: > > ============ > > # modprobe ipip > > # echo 1 > /proc/sys/net/ipv4/ip_forward > > # ip tunnel add tunl1 mode ipip ttl 32 local 192.168.200.12 remote > 192.168.200.11 > > # ip link set tunl1 up arp off > > # echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter > > # echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter > > # echo 2 > /proc/sys/net/ipv4/conf/tunl0/rp_filter > > # echo 2 > /proc/sys/net/ipv4/conf/tunl1/rp_filter > > > > vagrant@debian-9-dns:~$ sudo tcpdump -e -n -s 0 -i tunl1 -vv > > tcpdump: listening on tunl1, link-type RAW (Raw IP), capture size 262144 > bytes > > 10:16:13.919646 ip: (tos 0x0, ttl 64, id 63545, offset 0, flags [DF], proto > UDP (17), length 40) > > 192.168.200.10.51149 > 192.168.200.11.53: [udp sum ok] 26226 updateMA+ > [b2&3=0x6f6d] [27753a] [11619q] [25966n] [29706au][|domain] > > > > If I add an IP address to the interface the packet never reaches tunl1 > > # ip addr add 192.168.200.11/24 brd 192.168.200.11 dev tunl1 > > > > Notes: > > ====== > > > > LVS-DR was not an option because the real servers will be in different > subnets (I was able to get LVS-DR working though). > > > > I am looking for advice on how to better understand or resolve this issue. > Or, who would be better to answer this question. > > > > I have groked as many articles on how to setup this configuration as I can. > And, I have read a good deal of the archives of this mailing list. > > > > Linux distributions I have tried are Debian, Ubuntu and Amazon linux. This > is been tested on both AWS and VMware fusion. > > > > ------ > > > > I have a feeling I am missing something simple... > > > > Thanks! > > -Timothy > _______________________________________________ > Please read the documentation before posting - it's available at: > http://www.linuxvirtualserver.org/ > > LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org > Send requests to lvs-users-requ...@linuxvirtualserver.org > or go to http://lists.graemef.net/mailman/listinfo/lvs-users _______________________________________________ Please read the documentation before posting - it's available at: http://www.linuxvirtualserver.org/ LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org Send requests to lvs-users-requ...@linuxvirtualserver.org or go to http://lists.graemef.net/mailman/listinfo/lvs-users
