diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2009-05-06 13:01:20 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2009-05-06 13:01:20 +0200 |
commit | cd958a6c92c84095a439780b53832bb3aae2d512 (patch) | |
tree | 2b70f04e2796ef8e543b98e433ed305b8eb56974 /extensions/libxt_cluster.man | |
parent | 467fa9fe70f08342a50b859ddd431c848a956679 (diff) |
extensions: add `cluster' match support
This patch adds support for the cluster match to iptables.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_cluster.man')
-rw-r--r-- | extensions/libxt_cluster.man | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/extensions/libxt_cluster.man b/extensions/libxt_cluster.man new file mode 100644 index 00000000..6081be14 --- /dev/null +++ b/extensions/libxt_cluster.man @@ -0,0 +1,62 @@ +Allows you to deploy gateway and back-end load-sharing clusters without the +need of load-balancers. +.PP +This match requires that all the nodes see the same packets. Thus, the cluster +match decides if this node has to handle a packet given the following options: +.TP +\fB\-\-cluster\-total\-nodes \fInum\fP +Set number of total nodes in cluster. +.TP +[\fB!\fP] \fB\-\-cluster\-local\-node \fInum\fP +Set the local node number ID. +.TP +[\fB!\fP] \fB\-\-cluster\-local\-nodemask \fImask\fP +Set the local node number ID mask. You can use this option instead +of \fB\-\-cluster\-local\-node. +.TP +\fB\-\-cluster\-hash\-seed \fIvalue\fP +Set seed value of the Jenkins hash. +.PP +Example: +.IP +iptables \-A PREROUTING \-t mangle \-i eth1 \-m cluster \ +\-\-cluster\-total\-nodes 2 \-\-cluster\-local\-node 1 \ +\-\-cluster\-hash\-seed 0xdeadbeef \ +\-j MARK \-\-set-mark 0xffff +.IP +iptables \-A PREROUTING \-t mangle \-i eth2 \-m cluster \ +\-\-cluster\-total\-nodes 2 \-\-cluster\-local\-node 1 \ +\-\-cluster\-hash\-seed 0xdeadbeef \ +\-j MARK -\-set\-mark 0xffff +.IP +iptables \-A PREROUTING \-t mangle \-i eth1 \ +\-m mark ! \-\-mark 0xffff \-j DROP +.IP +iptables \-A PREROUTING \-t mangle \-i eth2 \ +\-m mark ! \-\-mark 0xffff \-j DROP +.PP +And the following commands to make all nodes see the same packets: +.IP +ip maddr add 01:00:5e:00:01:01 dev eth1 +.IP +ip maddr add 01:00:5e:00:01:02 dev eth2 +.IP +arptables \-A OUTPUT \-o eth1 \-\-h\-length 6 \ +\-j mangle \-\-mangle-mac-s 01:00:5e:00:01:01 +.IP +arptables \-A INPUT \-i eth1 \-\-h-length 6 \ +\-\-destination-mac 01:00:5e:00:01:01 \ +\-j mangle \-\-mangle\-mac\-d 00:zz:yy:xx:5a:27 +.IP +arptables \-A OUTPUT \-o eth2 \-\-h\-length 6 \ +\-j mangle \-\-mangle\-mac\-s 01:00:5e:00:01:02 +.IP +arptables \-A INPUT \-i eth2 \-\-h\-length 6 \ +\-\-destination\-mac 01:00:5e:00:01:02 \ +\-j mangle \-\-mangle\-mac\-d 00:zz:yy:xx:5a:27 +.PP +In the case of TCP connections, pickup facility has to be disabled +to avoid marking TCP ACK packets coming in the reply direction as +valid. +.IP +echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose |