Building Scalable TFTP Cluster using LVS - Revision history

Jeffbearer: /* Monitoring */

2007-06-20T20:50:43Z

‎Monitoring

Jeffbearer: /* Monitoring */

2007-06-20T20:50:30Z

‎Monitoring

Jeffbearer: /* lvs.cf Configuration */

2007-06-12T19:25:41Z

‎lvs.cf Configuration

Jeffbearer: /* lvs.cf Configuration */

2007-06-08T16:44:41Z

‎lvs.cf Configuration

Jeffbearer: /* Conclusion */

2007-06-08T16:33:40Z

‎Conclusion

Jeffbearer: /* Architecture */

2007-06-08T16:32:14Z

‎Architecture

Jeffbearer: /* Introduction */

2007-06-08T16:31:16Z

‎Introduction

Jeffbearer at 16:30, 8 June 2007

2007-06-08T16:30:50Z

Jeffbearer: /* Introduction */

2007-06-08T16:22:28Z

‎Introduction

Wensong at 13:33, 4 July 2006

2006-07-04T13:33:54Z

New page

== Introduction ==

== Architecture ==

== Configuration Example ==

== Conclusion ==

{{lvs-example-stub}}

[[Category:LVS Examples|TFTP]]

← Older revision		Revision as of 20:50, 20 June 2007
Line 63:		Line 63:

	'''A Hangup with Red Hat Piranha''' -- [https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243908 Fixed in 0.8.6.2]		'''A Hangup with Red Hat Piranha''' -- [https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243908 Fixed in 0.8.6.2]
		+
	Another thing that is Red Hat Piranha Specific, but somebody here might run into it. This check_tftp script used with nanny, does not detect that a tftp server is not available, when the tftp client tries to time out it fails because the nanny process is blocking SIGALRM the signal that it uses on timeout. I had to compile nanny without it blocking SIGALRM as I could not find a way in a shell script to unblock that signal. Also nanny does not like when check_tftp returns with error codes. so I had to modify the script to always exit 0 instead of the different statuses it returns for Nagios.		Another thing that is Red Hat Piranha Specific, but somebody here might run into it. This check_tftp script used with nanny, does not detect that a tftp server is not available, when the tftp client tries to time out it fails because the nanny process is blocking SIGALRM the signal that it uses on timeout. I had to compile nanny without it blocking SIGALRM as I could not find a way in a shell script to unblock that signal. Also nanny does not like when check_tftp returns with error codes. so I had to modify the script to always exit 0 instead of the different statuses it returns for Nagios.

@@ Line 62: / Line 62: @@
 You may notice I call a check_tftp script, I took the [http://mathias-kettner.de/download/check_tftp Nagios Plugin].
-'''A Hangup with Red Hat Piranha'''
+'''A Hangup with Red Hat Piranha'''  -- [https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243908 Fixed in 0.8.6.2]
 Another thing that is Red Hat Piranha Specific, but somebody here might run into it. This check_tftp script used with nanny, does not detect that a tftp server is not available, when the tftp client tries to time out it fails because the nanny process is blocking SIGALRM the signal that it uses on timeout.  I had to compile nanny without it blocking SIGALRM as I could not find a way in a shell script to unblock that signal.  Also nanny does not like when check_tftp returns with error codes. so I had to modify the script to always exit 0 instead of the different statuses it returns for Nagios.

@@ Line 59: / Line 59: @@
+  }
-You may notice my check_tftp script, I took the [http://mathias-kettner.de/download/check_tftp Nagios Plugin] and it works great.
+====Monitoring====
 == Conclusion ==

@@ Line 27: / Line 27: @@
 ===lvs.cf Configuration===
-Then in the lvs.cf the config changes are simple, instead of the '''port''' option you use the '''fwmark''' option.  In my example I left the port option for fun, but I think it's ignored.
+I probably should not assume that everyone is using piranha, but that is the config I have so that is what I'll document.
   virtual tftp {

← Older revision		Revision as of 16:33, 8 June 2007
Line 61:		Line 61:
	== Conclusion ==		== Conclusion ==

		+	I conclude that I wish I had this wiki when I started figuring this one out. I pieced this together with info from [http://www.austintek.com/LVS/LVS-HOWTO/HOWTO/LVS-HOWTO.services.multi-port.html LVS-HOWTO services multi-port document].

	{{lvs-example-stub}}		{{lvs-example-stub}}

← Older revision		Revision as of 16:32, 8 June 2007
Line 12:		Line 12:
	== Architecture ==		== Architecture ==

		+	This configuration is on a Direct Routing layout. but it should not matter much.

	== Configuration Example ==		== Configuration Example ==

@@ Line 8: / Line 8: @@
 # Client:12345 -> LVS: 23456 (Ack)
-And this is where the problem is, with a port based config, the LVS router doesn't know to listen on some random high port so the packet is dropped.  The Real Server is listening on that port, but the client doesn't know anything about the real server.
+And this is where the problem is, with a port based config, the LVS router doesn't know to listen on some random high port so the packet is dropped.  The Real Server is listening on that port, but the client doesn't know anything about the real server.  This is where firewall marks come in to play, set up iptables rules on the lvs servers that mark all of your TFTP packets.
-−
-This is where firewall marks come in to play, set up iptables rules on the lvs servers that mark all of your TFTP packets.
-−
-−
 == Architecture ==

@@ Line 10: / Line 10: @@
 And this is where the problem is, with a port based config, the LVS router doesn't know to listen on some random high port so the packet is dropped.  The Real Server is listening on that port, but the client doesn't know anything about the real server.
-This is where firewall marks come in to play, set up iptables rules on the lvs servers that mark all of your TFTP packets.  Since TFTP uses any unprivileged port it's kind of like the carpet bombing of port selection.  And this will limit you to making TFTP the only UDP service that uses unprivileged ports for that particular Virtural Service IP.
+This is where firewall marks come in to play, set up iptables rules on the lvs servers that mark all of your TFTP packets.
   iptables -t mangle -A PREROUTING -i eth0 -p udp -s 0.0.0.0/0 -d <VIRTUAL IP> --dport 69 -j MARK --set-mark 1
   iptables -t mangle -A PREROUTING -i eth0 -p udp -s 0.0.0.0/0 -d <VIRTUAL IP> --dport 1024:65535 -j MARK --set-mark 1
-You will want to put those in an init script, or rc.local that runs on both of your LVS Directors.
+Put those in an init script, or rc.local that runs on both of the LVS Directors.
-Then in the lvs.cf it's super simple, instead of the port option you use the fwmark option.  I left the port option for fun, but I think it's ignored.
+===lvs.cf Configuration===
   virtual tftp {
@@ Line 45: / Line 58: @@
           weight = 1
+      }
-−
+ }
-−
-You can get the check_tftp script from the nagios plugins.
-−
-== Architecture ==
-−
-−
-== Configuration Example ==
 == Conclusion ==

← Older revision		Revision as of 16:22, 8 June 2007
Line 1:		Line 1:
	== Introduction ==		== Introduction ==

		+	TFTP is a bit tricky because of how the protocol works. The client sends Ack's to the same port from which the data came from the server. This is problematic with a port based LVS setup because the client ends up sending packets to the VIP on a port that it is not expecting packets. The answer to this is to use firewall marks.
		+
		+	TFTP Protocol:
		+	# Client:12345 -> LVS: 69 (Request File)
		+	# LVS:23456 -> Client: 12345 (Data)
		+	# Client:12345 -> LVS: 23456 (Ack)
		+
		+	And this is where the problem is, with a port based config, the LVS router doesn't know to listen on some random high port so the packet is dropped. The Real Server is listening on that port, but the client doesn't know anything about the real server.
		+
		+	This is where firewall marks come in to play, set up iptables rules on the lvs servers that mark all of your TFTP packets. Since TFTP uses any unprivileged port it's kind of like the carpet bombing of port selection. And this will limit you to making TFTP the only UDP service that uses unprivileged ports for that particular Virtural Service IP.
		+
		+	iptables -t mangle -A PREROUTING -i eth0 -p udp -s 0.0.0.0/0 -d <VIRTUAL IP> --dport 69 -j MARK --set-mark 1
		+	iptables -t mangle -A PREROUTING -i eth0 -p udp -s 0.0.0.0/0 -d <VIRTUAL IP> --dport 1024:65535 -j MARK --set-mark 1
		+
		+	You will want to put those in an init script, or rc.local that runs on both of your LVS Directors.
		+
		+	Then in the lvs.cf it's super simple, instead of the port option you use the fwmark option. I left the port option for fun, but I think it's ignored.
		+
		+	virtual tftp {
		+	active = 1
		+	address = <VIRTUAL IP> eth0:1
		+	vip_nmask = 255.255.255.0
		+	fwmark = 1
		+	port = 69
		+	persistent = 45
		+	expect = "OK - answer from server"
		+	use_regex = 0
		+	send_program = "/usr/local/bin/check_tftp --connect %h"
		+	load_monitor = none
		+	scheduler = wlc
		+	protocol = udp
		+	timeout = 6
		+	reentry = 15
		+	quiesce_server = 1
		+	server ftp1 {
		+	address = 10.0.0.2
		+	active = 1
		+	weight = 1
		+	}
		+	server ftp2 {
		+	address = 10.0.0.3
		+	active = 1
		+	weight = 1
		+	}
		+	}
		+
		+	You can get the check_tftp script from the nagios plugins.

	== Architecture ==		== Architecture ==