0

I'm implementing a central pool of servers to handle "over capacity" error messages in a legacy network, and I'm under the impression that I need to do some tricky policy based routing with consideration for the source mac address.

There are multiple load balancers (approx 140) in sets of 2. Each set of load balancers has an internal and external VIP associated with that set.

For example:

          +-------------+    +--------------------+             +--------------+
          |             |    |                    | 10.1.1.253  |              |
          |             +----+  F5 Load Balancer  +-------------+              |
          |             |    |         1          |             |              |
External  |  VIP        |    +--------------------+             |  VIP         |  Internal
+---------+  133.1.1.1  |                                       |  10.1.1.254  +--------+
          |             |    +--------------------+             |              |
          |             |    |                    | 10.1.1.252  |              |
          |             +----+  F5 Load Balancer  +-------------+              |
          |             |    |         2          |             |              |
          +-------------+    +--------------------+             +--------------+

There are 70+ sets of these load balancers. Each load balancer has been assigned an IP in the 10.1.1.0/24 range, and a VIP.

I'm creating a central pool of servers that each range/load balancer set should be able to forward traffic to, and get a response from.

Each request should direct traffic back through the Internal VIP associated with the loadbalancer set it originated from.

Thus:

  • Client at 1.1.1.1 (external) issues request to VIP 133.1.1.1 (external)
  • Request is passed to active load balancer in set (eg: F5 LB1 - 10.1.1.253)
  • Request is passed to backend (at 10.1.1.2, for example)
  • Response is generated and returned to 10.1.1.254 (Internal VIP)

The F5 load balancers (as I understand it) are Layer4 balancers.

Incoming packets have the following structure:

+-------+------------------+---------------------+
| Layer | Source           | Destination         |
| ----- | ---------------- | ------------------- |
| MAC   | F5 LB 1          | Backend1            |
| IP    | Client (1.1.1.1) | Backend1 (10.1.1.2) |
+-------+------------------+---------------------+

Based on the MAC address source, from a known/static mapping, I should return the response to this request to the internal VIP for that load balancer.

So far I've been trying the following, marking of packets and related traffic from source MAC addresses, with a mark that indicates its known source IP. Than crafting routing tables per VIP.

Packets are coming in, but I cannot trace / find out where outbound packets are going.

echo "101 ens192-254" >> /etc/iproute2/rt_tables

ip rule add fwmark 0x253 table ens192-254
ip rule add fwmark 0x252 table ens192-254

ip route add 10.1.1.0/24 dev ens192 src 10.1.1.2 table ens192-254
ip route add default via 10.1.1.254 dev ens192 table ens192-254
ip route flush cache

iptables --table mangle --append PREROUTING \
  --match mac --mac-source 00:0a:49:fa:19:aa \
  --jump MARK --set-mark 0x253
iptables --table mangle --append PREROUTING \
  --match mac --mac-source 00:0a:49:fa:19:aa \
  --match state --state NEW,RELATED \
  --jump CONNMARK --set-mark 0x253

iptables --table mangle --append PREROUTING \
  --match mac --mac-source 00:0a:49:fa:06:bb \
  --jump MARK --set-mark 0x252
iptables --table mangle --append PREROUTING \
  --match mac --mac-source 00:0a:49:fa:06:bb \
  --match state --state NEW,RELATED \
  --jump CONNMARK --set-mark 0x252

iptables --table mangle --append PREROUTING \
  --jump CONNMARK --restore-mark

How to improve/fix these iptables rules/mangling in such a way that I can direct the traffic correctly?

The linux box(es) that I control are connected to 3 networks.

  • ens192 - The load balancer network (10.1.1.0/24)
  • ens160 - A secondary load balancer network (omitted in example for simplicity)
  • ens224 - Default route / shared network (required as default gateway so I can SSH into it).

Network Diagram

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.