[lvs-users] Fwd: Firewall clustering

Michael Schwartzkopff misch at clusterbau.com
Tue May 17 13:09:07 BST 2011

> > the usual way that LVS is used with pacemaker is that you have a HA pair
> > of LVS laod balancer boxes that load balance across a farm of additional
> > servers, but the LVS boxes themselves are active/bassive
> Thanks, I will take a look.
> No. CLUSTERIP only works on the INPUT chain, not on the forward chain.
> > Believe me that you do not want to setup an active/active firewall, but
> > an active/passive cluster.
> What do you mean? Could you be more specific?
> OK to not user CLUSTERIP. But what about an active/active cluster for
> firewalling? Is there any problem?

Yes. How can you distribute traffic over both systems? The only idea I have are 
FWMARKs and loadbalancing according to the MARKs. But is too much effort for a 
simple firewall.

My advise: Do an active/passive cluster setup WITHOUT loadbalancing. You can 
configure state table sync. Every normal hardware today is able to firewall 
1Gbit/s traffic. No need to add load balancing.


Dr. Michael Schwartzkopff
Guardinistr. 63
81375 München

Tel: (0163) 172 50 98
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://lists.graemef.net/pipermail/lvs-users/attachments/20110517/10e8cd1c/attachment-0001.bin 

More information about the lvs-users mailing list