0

On Ubuntu 14, I'm trying to set up a load balancer that uses haproxy for web connections and LVS-NAT for FTP, controlled by ldirectord, with pacemaker for automatic failover to a redundant host. The em1 interface has a public IP address and the em2 interface has a private IP address for talking to the back end servers.

Passive FTP through the kernel load balancer doesn't work, but active FTP does. When using a passive FTP client, the data connection will not establish, so directory listings and file transfers don't work. The FTP control channel on port 21 does work. There are two FTP servers for high availability.

I have the ip_vs_ftp module loaded. The ufw firewall is entirely disabled, because there is a Cisco firewall in front of all the hardware. I would really prefer to not have the firewall enabled ... but I did notice that every HOWTO out there for getting FTP to work through LVS also mentions how to set up the firewall.

This is the ldirectord config:

checktimeout=5
checkinterval=10
negotiatetimeout=20
autoreload=yes
logfile="/var/log/ldirectord.log"
quiescent=no

virtual=XX.XXX.XXX.71:21

 fallback=127.0.0.1:21  
 real=10.100.2.61:21 masq 65535  
 real=10.100.2.60:21 masq 1  
 service=ftp  
 request="monitortest.txt"  
 receive="good"  
 login="USER"  
 passwd="PASSWD"  
 scheduler=wrr  
 protocol=tcp  
 checktype=negotiate  

I'm migrating a working setup from CentOS 5, which is ancient. This all works perfectly on that CentOS 5 machine. The firewall is disabled on that machine.

How can I make this work like it does in the much older kernel?

0

Shawn,

As discussed on the HAProxy mailing list, I'm pretty sure you need to enable conntrack as well as ip_vs_ftp, then it should work fine.

2
  • Is there something more that needs to be done besides "ufw enable", adding an entry in /etc/ufw/applications.d for FTP, and allowing that new app entry? I ask because I tried that on a lab machine and it didn't change anything. – elyograg May 13 '15 at 16:35
  • I did ultimately get it working with haproxy, not using the kernel load balancer at all. The firewall was required. Now I need to allow some additional traffic through the firewall to the back end servers, and I have no idea how to do that. – elyograg May 23 '15 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.