Load balancing through NAT

[CoderGnome]

Hi everyone.
I just finished setting up a load balancing Gentoo Linux box, using LVS (Linux Virtual Server) and IP Tables for load balancing and NAT/firewall respectively.

Everything works at this time, except that this box also needs to pass FTP through the firewall. Even though this is a 1:1 mapping to a back-end (Windows) machine at this time, this could change. Thus, I am using IPVS for all incoming connections. However, because there are multiple backend machine, I am using non-standard ports (2121-2123). This seems to be the root of the problem.

Unfortunately, the ip_conntrack_ftp and ip_nat_ftp modules do not seem to be doing anything. I have passed the ports= module arguments to the modules on load (through /etc/modules.conf). I compiled them with debugging on, by changing an #if 0 to #if 1 in the .c files for the modules, but all they say in the system logs for the connections are "ftp: Conntrackinfo = 2" for each packet. From reading the source for the modules, it would seem like that should be what it does only on the initial packets, before the connection is established.

I would very much appreciate any help with this. I have bashed my head against this problem for some time now, and my boss is anxious for this hurdle to be behind us. This also represents a significant inroad for Linux into this company (I'm a huge Linux fan, especially Gentoo Linux; as mentioned before, the other machines are all Windows).

Thanks in advance.

[CoderGnome]

I have made a fair bit of progress, but it's still not quite right.

I did some more searching around, and found the ip_vs_ftp module, which I did not have installed (duh). I have loaded it now, and things are working better. The PORT command is being mangled right to show the external IP, not the internal IP like it was before, which is good. However, the firewall was eating the data connections. I opened it right up by removing the DROP rules and setting the default policies to ACCEPT, and now it works fine. However, I can't figure out what the iptables rule should be to lock this down again, but still allow the FTP data connection.

Also, "ftp: Conntrackinfo = 2" still appears repeatedly in the logs, one for every packet over the FTP data connection. Is this normal?

[richard.scott]

Can you post your config scripts?

What packet management method are you using? DUN, TUN, NAT?

Are you using keepalived for the LVS management?