Red Hat Cluster Suite, Руководство пользователя

Страница: 127 / 188

Chapter 9. Setting Up a Red Hat Enterprise Linux LVS Cluster 111
9.4.3.1. Rules for Active Connections
The rules for active connections tell the kernel to accept and forward connections coming
to the internal floating IP address on port 20 — the FTP data port.
iptables
/sbin/iptables -t nat -A POSTROUTING -p tcp \
-s
n.n.n
.0/24 --sport 20 -j MASQUERADE
In the above
iptables
commands,
n.n.n
should be replaced with the first three val-
ues for the floating IP for the NAT interface’s internal network interface defined in the
GLOBAL SETTINGS
panel of
Piranha Configuration Tool
. The command allows the
LVS router to accept outgoing connections from the real servers that IPVS does not know
about.
9.4.3.2. Rules for Passive Connections
The rules for passive connections assign the appropriate firewall mark to connections com-
ing in from the Internet to the floating IP for the service on a wide range of ports — 10,000
to 20,000.
Warning
If you are limiting the port range for passive connections, you must also configure the
VSFTP server to use a matching port range. This can be accomplished by adding the
following lines to
/etc/vsftpd.conf
:
pasv_min_port=10000
pasv_max_port=20000
You must also control the address that the server displays to the client for passive FTP
connections. In a NAT routed LVS system, add the following line to
/etc/vsftpd.conf
to override the real server IP address to the VIP, which is what the client sees upon
connection. For example:
pasv_address= X.X.X.X
Replace X.X.X.X with the VIP address of the LVS system.
For configuration of other FTP servers, consult the respective documentation.
This range should be a wide enough for most situations; however, you can increase this
number to include all available non-secured ports by changing
10000:20000
in the com-
mands below to
1024:65535
.