[lvs-users] DR-TUN Issues: Packets become martians on real server

Timothy R. Weiand timothy.weiand at gmail.com
Fri Jul 14 16:13:10 BST 2017

I am building a DR-TUN configuration to load balance DNS traffic. My issue
is with the real servers: the ipip packet get unwrapped and appears on the
tunnel interface and becomes a martian. Also, I have not been able to
determine how to bind to the tunnel interface to capture these packets. I
have verified details with tcpdump/dmesg. All my configuration is scripted
to ensure reproducibility. tcpdumps below do not show real DNS traffic;
using netcat to send text.

Much more detail can be supplied, please request it.



- All machines are currently Debian 9 (4.9.30-2+deb9u2)

- Client:

- Director:

- Real Server:

- No VIP: I am using the IP address for my director interface -

Director Configuration:


vagrant at debian-9-lb:~$ sudo ipvsadm -Ln

IP Virtual Server version 1.2.1 (size=4096)

Prot LocalAddress:Port Scheduler Flags

  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn

UDP rr

  ->            Tunnel  1      0          0

Real Server:


# modprobe ipip

# echo 1 > /proc/sys/net/ipv4/ip_forward

# ip tunnel add tunl1 mode ipip ttl 32 local remote

# ip link set tunl1 up arp off

# echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter

# echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter

# echo 2 > /proc/sys/net/ipv4/conf/tunl0/rp_filter

# echo 2 > /proc/sys/net/ipv4/conf/tunl1/rp_filter

vagrant at debian-9-dns:~$ sudo tcpdump -e -n -s 0 -i tunl1 -vv

tcpdump: listening on tunl1, link-type RAW (Raw IP), capture size 262144

10:16:13.919646 ip: (tos 0x0, ttl 64, id 63545, offset 0, flags [DF], proto
UDP (17), length 40) > [udp sum ok] 26226 updateMA+
[b2&3=0x6f6d] [27753a] [11619q] [25966n] [29706au][|domain]

If I add an IP address to the interface the packet never reaches tunl1

# ip addr add brd dev tunl1



LVS-DR was not an option because the real servers will be in different
subnets (I was able to get LVS-DR working though).

I am looking for advice on how to better understand or resolve this issue.
Or, who would be better to answer this question.

I have groked as many articles on how to setup this configuration as I can.
And, I have read a good deal of the archives of this mailing list.

Linux distributions I have tried are Debian, Ubuntu and Amazon linux. This
is been tested on both AWS and VMware fusion.


I have a feeling I am missing something simple...



More information about the lvs-users mailing list