[lvs-users] Strange error (bug?) with source NAT

Michael Schwartzkopff ms at sys4.de
Thu Dec 10 13:01:33 GMT 2015


For a test I set up  a LVS that should balance a telnet service inside a LAN.

So the client IP ist
the virtual IP is

and the real servers IPs are and 4.

I prepared my loadbalancer:
echo "1" > /proc/sys/net/ip4/ip_forward
echo "1" > /proc/sys/net/ipv4/vs/conntrack

and added:

iptables -t nat -I POSTROUTING -p tcp -s -d \
  --destination-port=23 -j MASQUERADE
iptables -t nat -I POSTROUTING -p tcp -s -d \
  --destination-port=23 -j MASQUERADE

the ipvs config is:

ipvsadm -A -t -s rr
ipvsadm -a -t -r -m -w 1
ipvsadm -a -t -r -m -w 1

Now a strange thing happens. A telnet fron the client does NOT work

# telnet

UNTIL I start tcpdump on the loadbalacer. When I watch the traffic everything 
works. I do not watch, telnet fails. The behavoiur is absolutely reproducable.

Oh, the interface of my loadbalancer ist a bridge br0 over the single 
interface eth0.

Did anybody implement some quantum computing in the ipvs module?
Anybody has a explanation for that behaviour?

Mit freundlichen Grüßen,

Michael Schwartzkopff

[*] sys4 AG

http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 230 bytes
Desc: This is a digitally signed message part.
Url : http://lists.graemef.net/pipermail/lvs-users/attachments/20151210/669e00ea/attachment.bin 

More information about the lvs-users mailing list