Mailing List Archive

[lvs-users] LVS Direct Routing Virtualized
Hi,

I have my LVS DR routing setup on a KVM nodes, from a single node it works
great.

Client->VIP->router dnat->loadbalancer->real server->router
snat->VIP->client

However when I spread the load across multiple KVM nodes, the connections
still hit the real server however nothing seems to be going out

Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)

I can see the traffic hitting the real server through the access logs, and
a tcpdump shows it's trying to send the response out. 10.0.3.152 being my
virtual IP. But the client doesn't seem to get the traffic.

16:35:47.370392 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http:
Flags [S], seq 4091323321, win 14600, options [mss 1400,sackOK,TS val
25401631 ecr 0,nop,wscale 7], length 0
16:35:47.370472 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046:
Flags [S.], seq 4086913213, ack 4091323322, win 14600, options [mss
1460,nop,nop,sackOK,nop,wscale 9], length 0
16:35:47.383519 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http:
Flags [.], ack 1, win 115, length 0
16:35:47.394633 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http:
Flags [P.], seq 1:372, ack 1, win 115, length 371
16:35:47.394653 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046:
Flags [.], ack 372, win 31, length 0
16:35:47.394846 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046:
Flags [P.], seq 1:377, ack 372, win 31, length 376
16:35:47.406866 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http:
Flags [.], ack 377, win 123, length 0
16:35:47.412737 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [S], seq 1141657121, win 14600, options [mss 1400,sackOK,TS val
25401671 ecr 0,nop,wscale 7], length 0
16:35:47.412760 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047:
Flags [S.], seq 954827421, ack 1141657122, win 14600, options [mss
1460,nop,nop,sackOK,nop,wscale 9], length 0
16:35:47.416050 IP 112-113-114-23.optusnet.com.au.41048 > 10.0.3.152.http:
Flags [S], seq 431016436, win 14600, options [mss 1400,sackOK,TS val
25401671 ecr 0,nop,wscale 7], length 0
16:35:47.416064 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41048:
Flags [S.], seq 3260231345, ack 431016437, win 14600, options [mss
1460,nop,nop,sackOK,nop,wscale 9], length 0
16:35:47.424931 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [.], ack 1, win 115, length 0
16:35:47.435810 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [P.], seq 1:376, ack 1, win 115, length 375
16:35:47.435822 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047:
Flags [.], ack 376, win 31, length 0
16:35:47.440424 IP 112-113-114-23.optusnet.com.au.41048 > 10.0.3.152.http:
Flags [.], ack 1, win 115, length 0
16:35:47.472455 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047:
Flags [P.], seq 1:471, ack 376, win 31, length 470
16:35:47.484230 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [.], ack 471, win 123, length 0
16:35:47.594953 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [P.], seq 376:659, ack 471, win 123, length 283
16:35:47.597063 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047:
Flags [P.], seq 471:1183, ack 659, win 33, length 712
16:35:47.610358 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http:
Flags [.], ack 1183, win 134, length 0


Any suggestions?
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
Re: [lvs-users] LVS Direct Routing Virtualized [ In reply to ]
Andrew Lau <andrew@andrewklau.com> writes:

> I have my LVS DR routing setup on a KVM nodes, from a single node it works
> great.
>
> Client->VIP->router dnat->loadbalancer->real server->router
> snat->VIP->client
>
> However when I spread the load across multiple KVM nodes, the connections
> still hit the real server however nothing seems to be going out
>
> Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)
>
> I can see the traffic hitting the real server through the access logs, and
> a tcpdump shows it's trying to send the response out. 10.0.3.152 being my
> virtual IP. But the client doesn't seem to get the traffic.

The client certainly gets the traffic, these seem like normal TCP
session startups to me, with both ends actively involved.

> 16:35:47.370392 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http: Flags [S], seq 4091323321, win 14600, options [mss 1400,sackOK,TS val 25401631 ecr 0,nop,wscale 7], length 0
> 16:35:47.370472 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046: Flags [S.], seq 4086913213, ack 4091323322, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9], length 0
> 16:35:47.383519 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
> 16:35:47.394633 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http: Flags [P.], seq 1:372, ack 1, win 115, length 371
> 16:35:47.394653 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046: Flags [.], ack 372, win 31, length 0
> 16:35:47.394846 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41046: Flags [P.], seq 1:377, ack 372, win 31, length 376
> 16:35:47.406866 IP 112-113-114-23.optusnet.com.au.41046 > 10.0.3.152.http: Flags [.], ack 377, win 123, length 0

> 16:35:47.412737 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [S], seq 1141657121, win 14600, options [mss 1400,sackOK,TS val 25401671 ecr 0,nop,wscale 7], length 0
> 16:35:47.412760 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047: Flags [S.], seq 954827421, ack 1141657122, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9], length 0
> 16:35:47.424931 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
> 16:35:47.435810 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [P.], seq 1:376, ack 1, win 115, length 375
> 16:35:47.435822 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047: Flags [.], ack 376, win 31, length 0
> 16:35:47.472455 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047: Flags [P.], seq 1:471, ack 376, win 31, length 470
> 16:35:47.484230 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [.], ack 471, win 123, length 0
> 16:35:47.594953 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [P.], seq 376:659, ack 471, win 123, length 283
> 16:35:47.597063 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41047: Flags [P.], seq 471:1183, ack 659, win 33, length 712
> 16:35:47.610358 IP 112-113-114-23.optusnet.com.au.41047 > 10.0.3.152.http: Flags [.], ack 1183, win 134, length 0

> 16:35:47.416050 IP 112-113-114-23.optusnet.com.au.41048 > 10.0.3.152.http: Flags [S], seq 431016436, win 14600, options [mss 1400,sackOK,TS val 25401671 ecr 0,nop,wscale 7], length 0
> 16:35:47.416064 IP 10.0.3.152.http > 112-113-114-23.optusnet.com.au.41048: Flags [S.], seq 3260231345, ack 431016437, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9], length 0
> 16:35:47.440424 IP 112-113-114-23.optusnet.com.au.41048 > 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
--
Regards,
Feri.

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
Re: [lvs-users] LVS Direct Routing Virtualized [ In reply to ]
On Sat, Sep 21, 2013 at 9:57 PM, Ferenc Wagner <wferi@niif.hu> wrote:

> Andrew Lau <andrew@andrewklau.com> writes:
>
> > I have my LVS DR routing setup on a KVM nodes, from a single node it
> works
> > great.
> >
> > Client->VIP->router dnat->loadbalancer->real server->router
> > snat->VIP->client
> >
> > However when I spread the load across multiple KVM nodes, the connections
> > still hit the real server however nothing seems to be going out
> >
> > Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)
> >
> > I can see the traffic hitting the real server through the access logs,
> and
> > a tcpdump shows it's trying to send the response out. 10.0.3.152 being my
> > virtual IP. But the client doesn't seem to get the traffic.
>
> The client certainly gets the traffic, these seem like normal TCP
> session startups to me, with both ends actively involved.
>

That's what it definitely looked like, the router packet scan even showed
the packets flowing from the VM however the client is not getting the end
result. Just timing out.

Could it be because I'm running NAT between the router->loadbalancer? This
may be an issue with router config, but I'm lost on what could be the
possible issue.

>
> > 16:35:47.370392 IP 112-113-114-23.optusnet.com.au.41046 >
> 10.0.3.152.http: Flags [S], seq 4091323321, win 14600, options [mss
> 1400,sackOK,TS val 25401631 ecr 0,nop,wscale 7], length 0
> > 16:35:47.370472 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41046: Flags [S.], seq 4086913213, ack
> 4091323322, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9],
> length 0
> > 16:35:47.383519 IP 112-113-114-23.optusnet.com.au.41046 >
> 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
> > 16:35:47.394633 IP 112-113-114-23.optusnet.com.au.41046 >
> 10.0.3.152.http: Flags [P.], seq 1:372, ack 1, win 115, length 371
> > 16:35:47.394653 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41046: Flags [.], ack 372, win 31, length 0
> > 16:35:47.394846 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41046: Flags [P.], seq 1:377, ack 372, win
> 31, length 376
> > 16:35:47.406866 IP 112-113-114-23.optusnet.com.au.41046 >
> 10.0.3.152.http: Flags [.], ack 377, win 123, length 0
>
> > 16:35:47.412737 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [S], seq 1141657121, win 14600, options [mss
> 1400,sackOK,TS val 25401671 ecr 0,nop,wscale 7], length 0
> > 16:35:47.412760 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41047: Flags [S.], seq 954827421, ack
> 1141657122, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9],
> length 0
> > 16:35:47.424931 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
> > 16:35:47.435810 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [P.], seq 1:376, ack 1, win 115, length 375
> > 16:35:47.435822 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41047: Flags [.], ack 376, win 31, length 0
> > 16:35:47.472455 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41047: Flags [P.], seq 1:471, ack 376, win
> 31, length 470
> > 16:35:47.484230 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [.], ack 471, win 123, length 0
> > 16:35:47.594953 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [P.], seq 376:659, ack 471, win 123, length 283
> > 16:35:47.597063 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41047: Flags [P.], seq 471:1183, ack 659,
> win 33, length 712
> > 16:35:47.610358 IP 112-113-114-23.optusnet.com.au.41047 >
> 10.0.3.152.http: Flags [.], ack 1183, win 134, length 0
>
> > 16:35:47.416050 IP 112-113-114-23.optusnet.com.au.41048 >
> 10.0.3.152.http: Flags [S], seq 431016436, win 14600, options [mss
> 1400,sackOK,TS val 25401671 ecr 0,nop,wscale 7], length 0
> > 16:35:47.416064 IP 10.0.3.152.http >
> 112-113-114-23.optusnet.com.au.41048: Flags [S.], seq 3260231345, ack
> 431016437, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 9],
> length 0
> > 16:35:47.440424 IP 112-113-114-23.optusnet.com.au.41048 >
> 10.0.3.152.http: Flags [.], ack 1, win 115, length 0
> --
> Regards,
> Feri.
>
> _______________________________________________
> Please read the documentation before posting - it's available at:
> http://www.linuxvirtualserver.org/
>
> LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
> Send requests to lvs-users-request@LinuxVirtualServer.org
> or go to http://lists.graemef.net/mailman/listinfo/lvs-users
>
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
Re: [lvs-users] LVS Direct Routing Virtualized [ In reply to ]
Andrew Lau <andrew@andrewklau.com> writes:

> On Sat, Sep 21, 2013 at 9:57 PM, Ferenc Wagner <wferi@niif.hu> wrote:
>
>> Andrew Lau <andrew@andrewklau.com> writes:
>>
>>> I have my LVS DR routing setup on a KVM nodes, from a single node it
>>> works great.
>>>
>>> Client->VIP->router dnat->loadbalancer->real server->router
>>> snat->VIP->client
>>>
>>> However when I spread the load across multiple KVM nodes, the
>>> connections still hit the real server however nothing seems to be
>>> going out
>>>
>>> Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)
>>>
>>> I can see the traffic hitting the real server through the access
>>> logs, and a tcpdump shows it's trying to send the response
>>> out. 10.0.3.152 being my virtual IP. But the client doesn't seem to
>>> get the traffic.
>>
>> The client certainly gets the traffic, these seem like normal TCP
>> session startups to me, with both ends actively involved.
>
> That's what it definitely looked like, the router packet scan even showed
> the packets flowing from the VM however the client is not getting the end
> result. Just timing out.

I wonder who does the three way handshake and the data excange then,
all with correct sequence numbers... Make a packet trace on the client.

> Could it be because I'm running NAT between the router->loadbalancer?

10.0.3.152 is the DNAT target address for your real VIP, right? So the
packets go:

from to via
---------------------------------------------------
until DNAT: client VIP external gateway
after DNAT: client 10.0.3.152 internal gateway
after DR: client 10.0.3.152 realserver
reply: 10.0.3.152 client internal gateway
after SNAT: VIP client external gateway

I don't see any problem with this in principle, especially not anything
depending on the number of real servers.
--
Regards,
Feri.

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
Re: [lvs-users] LVS Direct Routing Virtualized [ In reply to ]
On Sun, Sep 22, 2013 at 12:09 AM, Ferenc Wagner <wferi@niif.hu> wrote:

> Andrew Lau <andrew@andrewklau.com> writes:
>
> > On Sat, Sep 21, 2013 at 9:57 PM, Ferenc Wagner <wferi@niif.hu> wrote:
> >
> >> Andrew Lau <andrew@andrewklau.com> writes:
> >>
> >>> I have my LVS DR routing setup on a KVM nodes, from a single node it
> >>> works great.
> >>>
> >>> Client->VIP->router dnat->loadbalancer->real server->router
> >>> snat->VIP->client
> >>>
> >>> However when I spread the load across multiple KVM nodes, the
> >>> connections still hit the real server however nothing seems to be
> >>> going out
> >>>
> >>> Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)
> >>>
> >>> I can see the traffic hitting the real server through the access
> >>> logs, and a tcpdump shows it's trying to send the response
> >>> out. 10.0.3.152 being my virtual IP. But the client doesn't seem to
> >>> get the traffic.
> >>
> >> The client certainly gets the traffic, these seem like normal TCP
> >> session startups to me, with both ends actively involved.
> >
> > That's what it definitely looked like, the router packet scan even showed
> > the packets flowing from the VM however the client is not getting the end
> > result. Just timing out.
>
> I wonder who does the three way handshake and the data excange then,
> all with correct sequence numbers... Make a packet trace on the client.
>
> > Could it be because I'm running NAT between the router->loadbalancer?
>
> 10.0.3.152 is the DNAT target address for your real VIP, right? So the
> packets go:
>
> from to via
> ---------------------------------------------------
> until DNAT: client VIP external gateway
> after DNAT: client 10.0.3.152 internal gateway
> after DR: client 10.0.3.152 realserver
> reply: 10.0.3.152 client internal gateway
> after SNAT: VIP client external gateway
>
> I don't see any problem with this in principle, especially not anything
> depending on the number of real servers.
>

Yup, that's the scenario.

My suspicions were correct though, when the LVS and realserver are on the
same KVM node the transmissions go through without an issue. But on
separate KVM nodes (same network) the real servers are receiving the
request but the client isn't getting anything and the tcpdump looked like
it was just the client sending re-transmissions to the real server, but the
real server packets aren't making it to the client.

If the client is within the same network though, it would seem to work so
it's pointing towards possibly a router issue. But I'm really stuck at
seeing why this is happening.

Thanks.


> --
> Regards,
> Feri.
>
> _______________________________________________
> Please read the documentation before posting - it's available at:
> http://www.linuxvirtualserver.org/
>
> LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
> Send requests to lvs-users-request@LinuxVirtualServer.org
> or go to http://lists.graemef.net/mailman/listinfo/lvs-users
>
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
Re: [lvs-users] LVS Direct Routing Virtualized [ In reply to ]
On Sun, Sep 22, 2013 at 11:16 AM, Andrew Lau <andrew@andrewklau.com> wrote:

> On Sun, Sep 22, 2013 at 12:09 AM, Ferenc Wagner <wferi@niif.hu> wrote:
>
>> Andrew Lau <andrew@andrewklau.com> writes:
>>
>> > On Sat, Sep 21, 2013 at 9:57 PM, Ferenc Wagner <wferi@niif.hu> wrote:
>> >
>> >> Andrew Lau <andrew@andrewklau.com> writes:
>> >>
>> >>> I have my LVS DR routing setup on a KVM nodes, from a single node it
>> >>> works great.
>> >>>
>> >>> Client->VIP->router dnat->loadbalancer->real server->router
>> >>> snat->VIP->client
>> >>>
>> >>> However when I spread the load across multiple KVM nodes, the
>> >>> connections still hit the real server however nothing seems to be
>> >>> going out
>> >>>
>> >>> Client->VIP->router dnat->LVS (kvm node 1)->real server (kvm node 2)
>> >>>
>> >>> I can see the traffic hitting the real server through the access
>> >>> logs, and a tcpdump shows it's trying to send the response
>> >>> out. 10.0.3.152 being my virtual IP. But the client doesn't seem to
>> >>> get the traffic.
>> >>
>> >> The client certainly gets the traffic, these seem like normal TCP
>> >> session startups to me, with both ends actively involved.
>> >
>> > That's what it definitely looked like, the router packet scan even
>> showed
>> > the packets flowing from the VM however the client is not getting the
>> end
>> > result. Just timing out.
>>
>> I wonder who does the three way handshake and the data excange then,
>> all with correct sequence numbers... Make a packet trace on the client.
>>
>> > Could it be because I'm running NAT between the router->loadbalancer?
>>
>> 10.0.3.152 is the DNAT target address for your real VIP, right? So the
>> packets go:
>>
>> from to via
>> ---------------------------------------------------
>> until DNAT: client VIP external gateway
>> after DNAT: client 10.0.3.152 internal gateway
>> after DR: client 10.0.3.152 realserver
>> reply: 10.0.3.152 client internal gateway
>> after SNAT: VIP client external gateway
>>
>> I don't see any problem with this in principle, especially not anything
>> depending on the number of real servers.
>>
>
> Yup, that's the scenario.
>
> My suspicions were correct though, when the LVS and realserver are on the
> same KVM node the transmissions go through without an issue. But on
> separate KVM nodes (same network) the real servers are receiving the
> request but the client isn't getting anything and the tcpdump looked like
> it was just the client sending re-transmissions to the real server, but the
> real server packets aren't making it to the client.
>
> If the client is within the same network though, it would seem to work so
> it's pointing towards possibly a router issue. But I'm really stuck at
> seeing why this is happening.
>
> Thanks.
>
>

I ended up skipping the NAT and assigning it a /32 address instead, and
that's solved my issue on routing and wasted address space. Thanks again
for your help.

Cheers

> --
>> Regards,
>> Feri.
>>
>> _______________________________________________
>> Please read the documentation before posting - it's available at:
>> http://www.linuxvirtualserver.org/
>>
>> LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
>> Send requests to lvs-users-request@LinuxVirtualServer.org
>> or go to http://lists.graemef.net/mailman/listinfo/lvs-users
>>
>
>
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users