3.4. Multi-port Services and Load Balancer
LVS routers under any topology require extra configuration when creating multi-port Load Balancer services. Multi-port services can be created artificially by using firewall marks to bundle together different, but related protocols, such as HTTP (port 80) and HTTPS (port 443), or when Load Balancer is used with true multi-port protocols, such as FTP. In either case, the LVS router uses firewall marks to recognize that packets destined for different ports, but bearing the same firewall mark, should be handled identically. Also, when combined with persistence, firewall marks ensure connections from the client machine are routed to the same host, as long as the connections occur within the length of time specified by the persistence parameter.
Although the mechanism used to balance the loads on the real servers, IPVS, can recognize the firewall marks assigned to a packet, it cannot itself assign firewall marks. The job of assigning firewall marks must be performed by the network packet filter,
iptables. The default firewall administration tool in Red Hat Enterprise Linux 7 is firewalld, which can be used to configure iptables. If preferred, iptables can be used directly. See Red Hat Enterprise Linux 7 Security Guide for information on working with iptables in Red Hat Enterprise Linux 7.
3.4.1. Assigning Firewall Marks Using firewalld
To assign firewall marks to a packet destined for a particular port, the administrator can use
firewalld's firewall-cmd utility.
If required, confirm that
firewalld is running:
# systemctl status firewalld
firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
Active: active (running) since Tue 2016-01-26 05:23:53 EST; 7h ago
To start firewalld, enter:
# systemctl start firewalld
To ensure firewalld is enabled to start at system start:
# systemctl enable firewalld
This section illustrates how to bundle HTTP and HTTPS as an example; however, FTP is another commonly clustered multi-port protocol.
The basic rule to remember when using firewall marks is that for every protocol using a firewall mark in Keepalived there must be a commensurate firewall rule to assign marks to the network packets.
Before creating network packet filter rules, make sure there are no rules already in place. To do this, open a shell prompt, login as
root, and enter the following command:
# firewall-cmd --list-rich-rules
If no rich rules are present the prompt will instantly reappear.
If
firewalld is active and rich rules are present, it displays a set of rules.
If the rules already in place are important, check the contents of
/etc/firewalld/zones/ and copy any rules worth keeping to a safe place before proceeding. Delete unwanted rich rules using a command in the following format: firewall-cmd --zone=zone --remove-rich-rule='rule' --permanentThe
--permanent option makes the setting persistent, but the command will only take effect at next system start. If required to make the setting take effect immediately, repeat the command omitting the --permanent option.
The first load balancer related firewall rule to be configured is to allow VRRP traffic for the Keepalived service to function. Enter the following command:
# firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
If the zone is omitted the default zone will be used.
Below are rules which assign the same firewall mark,
80, to incoming traffic destined for the floating IP address, n.n.n.n, on ports 80 and 443.
#firewall-cmd --add-rich-rule='rule family="ipv4" destination address="n.n.n.n/32" port port="80" protocol="tcp" mark set="80"' --permanent#firewall-cmd --add-rich-rule='rule family="ipv4" destination address="n.n.n.n/32" port port="443" protocol="tcp" mark set="80"' --permanent#firewall-cmd --reloadsuccess #firewall-cmd --list-rich-rulesrule protocol value="vrrp" accept rule family="ipv4" destination address="n.n.n.n/32" port port="80" protocol="tcp" mark set=80 rule family="ipv4" destination address="n.n.n.n/32" port port="443" protocol="tcp" mark set=80
If the zone is omitted the default zone will be used.
See the Red Hat Enterprise Linux 7 Security Guide for more information on the use of
firewalld's rich language commands.
3.4.2. Assigning Firewall Marks Using iptables
To assign firewall marks to a packet destined for a particular port, the administrator can use
iptables.
This section illustrates how to bundle HTTP and HTTPS as an example; however, FTP is another commonly clustered multi-port protocol.
The basic rule to remember when using firewall marks is that for every protocol using a firewall mark in Keepalived there must be a commensurate firewall rule to assign marks to the network packets.
Before creating network packet filter rules, make sure there are no rules already in place. To do this, open a shell prompt, login as
root, and enter the following command:
/usr/sbin/service iptables status
If
iptables is not running, the prompt will instantly reappear.
If
iptables is active, it displays a set of rules. If rules are present, enter the following command:
/sbin/service iptables stop
If the rules already in place are important, check the contents of
/etc/sysconfig/iptables and copy any rules worth keeping to a safe place before proceeding.
The first load balancer related configuring firewall rules is to allow VRRP traffic for the Keepalived service to function.
/usr/sbin/iptables -I INPUT -p vrrp -j ACCEPT
Below are rules which assign the same firewall mark,
80, to incoming traffic destined for the floating IP address, n.n.n.n, on ports 80 and 443.
/usr/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 -m multiport --dports 80,443 -j MARK --set-mark 80
Note that you must log in as
root and load the module for iptables before issuing rules for the first time.
In the above
iptables commands, n.n.n.n should be replaced with the floating IP for your HTTP and HTTPS virtual servers. These commands have the net effect of assigning any traffic addressed to the VIP on the appropriate ports a firewall mark of 80, which in turn is recognized by IPVS and forwarded appropriately.
Warning
The commands above will take effect immediately, but do not persist through a reboot of the system.
