Mailing List Archive

Hi Tomasz,

2014-03-07 11:52 GMT+01:00 Tomasz Chmielewski <tch@virtall.com>:
> I was wondering if I can use ipvsadm not only for load balancing, but
> also for "code testing".

The key to such usage, is fwmark based LVS virtual hosts. You then use
the iptables -t mangle PREROUTING to set firewall mark depending on
whatever iptables matches you come up with. Additionally ipset might
come in handy here - write one ipset based match setting your "code
testing" fwmark, then add and delete IPs from that set as needed,
maybe even with a nice web frontend for your developers :)

best regards
Patrick

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

On Fri, 7 Mar 2014 12:15:08 +0100
Patrick Schaaf <netdev@bof.de> wrote:

> Hi Tomasz,
>
> 2014-03-07 11:52 GMT+01:00 Tomasz Chmielewski <tch@virtall.com>:
> > I was wondering if I can use ipvsadm not only for load balancing,
> > but also for "code testing".
>
> The key to such usage, is fwmark based LVS virtual hosts. You then use
> the iptables -t mangle PREROUTING to set firewall mark depending on
> whatever iptables matches you come up with. Additionally ipset might
> come in handy here - write one ipset based match setting your "code
> testing" fwmark, then add and delete IPs from that set as needed,
> maybe even with a nice web frontend for your developers :)

Indeed.

iptables -t mangle -I PREROUTING -s 1.2.3.4 -j ACCEPT

on the realserver does the trick :)

--
Tomasz Chmielewski
http://wpkg.org



_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

Patrick Schaaf <netdev@bof.de> writes:

> 2014-03-07 11:52 GMT+01:00 Tomasz Chmielewski <tch@virtall.com>:
>
>> I was wondering if I can use ipvsadm not only for load balancing, but
>> also for "code testing".
>
> The key to such usage, is fwmark based LVS virtual hosts. You then use
> the iptables -t mangle PREROUTING to set firewall mark [...]

Just a note: you don't *have to* use the mangle table (though oldish
kernels restrict the MARK target to the mangle table), if you don't want
to base your routing decision on fwmarks. For LVS virtual services, you
don't.
--
Regards,
Feri.

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

On Fri, Mar 7, 2014 at 3:53 AM, Ferenc Wagner <wferi@niif.hu> wrote:

> Patrick Schaaf <netdev@bof.de> writes:
>
> > 2014-03-07 11:52 GMT+01:00 Tomasz Chmielewski <tch@virtall.com>:
> >
> >> I was wondering if I can use ipvsadm not only for load balancing, but
> >> also for "code testing".
> >
> > The key to such usage, is fwmark based LVS virtual hosts. You then use
> > the iptables -t mangle PREROUTING to set firewall mark [...]
>
> Just a note: you don't *have to* use the mangle table (though oldish
> kernels restrict the MARK target to the mangle table), if you don't want
> to base your routing decision on fwmarks. For LVS virtual services, you
> don't.
> --
> Regards,
> Feri.
>
>
>
I'm confused how this "iptables -t mangle -I PREROUTING -s 1.2.3.4 -j
ACCEPT" sets a mark? Doesn't Tomasz need to set a mark (*-j MARK --set-mark
1)* and then tell ipvsadm to route based on fwmark? i.e.: ipvsadm -A -f 1
-s wrr -p 80 ?

Cheers,
Alex
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

On Fri, 7 Mar 2014 09:18:48 -0800
Alex Attarian <u2sashko@gmail.com> wrote:

> I'm confused how this "iptables -t mangle -I PREROUTING -s 1.2.3.4 -j
> ACCEPT" sets a mark? Doesn't Tomasz need to set a mark (*-j MARK
> --set-mark 1)* and then tell ipvsadm to route based on fwmark? i.e.:
> ipvsadm -A -f 1 -s wrr -p 80 ?

"iptables -t mangle -I PREROUTING -s 1.2.3.4 -j ACCEPT" doesn't set any
mark, and that's exactly why it works: any rules setting the mark
later on are simply ignored, and requests from 1.2.3.4 hit the
webserver on this director/realserver.

One more thing I had to do was temporarily switching off this
realserver for the ldirectord (by simply setting the testpage/request to
give a bogus answer), but leaving it working otherwise.

This way, all client traffic gets directed to the healthy realserver,
while 1.2.3.4 can test the code on the other (seemingly offline for
ldirectord) realserver.

--
Tomasz Chmielewski
http://wpkg.org

_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

On Fri, Mar 7, 2014 at 9:26 AM, Tomasz Chmielewski <tch@virtall.com> wrote:

> On Fri, 7 Mar 2014 09:18:48 -0800
> Alex Attarian <u2sashko@gmail.com> wrote:
>
> > I'm confused how this "iptables -t mangle -I PREROUTING -s 1.2.3.4 -j
> > ACCEPT" sets a mark? Doesn't Tomasz need to set a mark (*-j MARK
> > --set-mark 1)* and then tell ipvsadm to route based on fwmark? i.e.:
> > ipvsadm -A -f 1 -s wrr -p 80 ?
>
> "iptables -t mangle -I PREROUTING -s 1.2.3.4 -j ACCEPT" doesn't set any
> mark, and that's exactly why it works: any rules setting the mark
> later on are simply ignored, and requests from 1.2.3.4 hit the
> webserver on this director/realserver.
>
> One more thing I had to do was temporarily switching off this
> realserver for the ldirectord (by simply setting the testpage/request to
> give a bogus answer), but leaving it working otherwise.
>
> This way, all client traffic gets directed to the healthy realserver,
> while 1.2.3.4 can test the code on the other (seemingly offline for
> ldirectord) realserver.
>
> --
> Tomasz Chmielewski
> http://wpkg.org
>

Sorry I missed the part where your director is also a real server... My
other thought was also fw marks only exist in the kernel of the machine and
never leave the machine, that's why it confused me why you were doing this
also on the real server. Never mind :)
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org
Send requests to lvs-users-request@LinuxVirtualServer.org
or go to http://lists.graemef.net/mailman/listinfo/lvs-users