Re: [LARTC] Multihome load balancing - kernel vs netfilter

2007-05-21 Thread Luciano Ruete
On Monday 14 May 2007 02:57, Peter Rabbitson wrote:
> Hi,
> I have searched the archives on the topic, and it seems that the list
> gurus favor load balancing to be done in the kernel as opposed to other
> means. 

AFAIKR there aren't conflicting opinions, there are just to different 
aproaches and i belive that routing solution is user cause it was the first 
and because sounds logical to implement multipath with your routing tool. 
But iptables has become in a routing tool so far (and much more).

Personaly im using multipath, but i do not dislike the iptables aproach.

> I have been using a home-grown approach, which splits traffic 
> based on `-m statistic --mode random --probability X`, then CONNMARKs
> the individual connections and the kernel happily routes them. I
> understand that for > 2 links it will become impractical to calculate a
> correct X. 

well, is not impractical with a litle of scripting in your firewal...
#!/bin/bash
# your uplinks weight as in kernel multipath
# ie:   link1 link2 link3 link4 link5
weight="  1 2 1 3 5  "
weight_total=
for n in $weight ; do
let weight_total=weight_total+n
done
for n in $weight ; do
probability=$((n*100/weight_total))
echo iptables.. -m statistic --mode random --probability $probability
done


but the problem arraise when you have lets say 101 links, cause mode random 
takes a 2 digit number right?, but this can be changed in the code (use the 
source...)

> But if we only have 2 gateways to the internet - are there 
> any advantages in letting the kernel multipath scheduler do the
> balancing (with all the downsides of route caching), as opposed to the
> pure random approach described above?

Well, the disvantage i see is that you have to move all your routing rules to 
iptables space, but in the end you always need the routing table, but it is a 
mather of change old habits...

-- 
Luciano
___
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


Re: [LARTC] ipip/gre tunnel behind NAT environments.

2007-05-21 Thread Ryan Castellucci

On 5/19/07, shetravel <[EMAIL PROTECTED]> wrote:

Hi, Does anyone tried to get ipip or gre tunnel behind NAT environments. ?
i'm trying to make both side tunneling with ipip or gre with private address
just like belows..


A ---FIRWWAL ---INET --- B
  PRIVATEPUBLIC
 PUBLIC
(10.100.0.1) (211.xxx.xxx.xxx)
(211.xxx.xxx.xxx)

is it possible to make both side connections with IPIP or GRE tunnels ?
thanks in advance.


If the firewall is a linux system, you should be able to easily use
DNAT to forward the ipip or gre packets to host 'A'.

Something like...

iptables -t nat -A PREROUTING -i [Firewall's internet facing
interface] -s [Host B's IP] -d [Firewall's public IP] -p ipip -j DNAT
--to-destination [Host A's IP]

I'm not sure if connection tracking will do any of this automatically,
but if it were going to work, A would have to send packets to B over
the tunnel first before B could send to A.

--
Ryan Castellucci http://ryanc.org/
___
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc