The LVS routers require Red Hat Linux 6.1 or greater. Also, packet forwarding, packet defragmenting, and IP masquerading must be enabled on the LVS routers.
To enable packet forwarding and defragmenting, make sure the following two lines are present in /etc/sysconf/network:
FORWARD_IPV4=yes
DEFRAG_IPV4=yes
These lines cause /etc/rc.d/rc.sysinit to execute these two commands whenever the routers boot:
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_always_defrag
To enable IP masquerading, issue this command:
ipchains -A forward -j MASQ -s n.n.n.n/type -d 0.0.0.0/0
where:
n.n.n.n is the address of the private subnet to which the real servers are connected.
type is 8, 16, 24, or 32 indicating the address type and mask:
netmask | type | Subnet
~~~~~~~~~~~~~~~~|~~~~~~|~~~~~~~~~~~~~~~
255.0.0.0 | 8 | Class A
255.255.0.0 | 16 | Class B
255.255.255.0 | 24 | Class C
255.255.255.255 | 32 | Point-to-point
|
You will probably want to put the ipchains command in an init script (e.g., /etc/rc.d/rc.local), so that masquerading is configured on the LVS routers at system startup.
ipchains is the tool used to create and manage firewalling rules set in the kernel's TCP stack. Masquerading is a small subset of these rules that allows machines making use of private IP networks to communicate with the outside world. Using ipchains can have an impact on system security. If you have security concerns, read the ipchains HOWTO (http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html).