Ezzel a datummal: Saturday 19 April 2008 10.39.29 Claer ezt mrta:
quoted text
> On Fri, Apr 18 2008 at 32:21, G?bri M?t? wrote:
> > Ezzel a datummal: Friday 18 April 2008 21.29.18 ezt mrta:
> > > On Fri, Apr 18, 2008 at 11:48 AM, Gabri Mati <gabrimate@duosol.hu>
wrote:
quoted text
> > > >  This is normal, but is there a way to make the outgoing package to
> > > > have the internal CARP device's address as source IP?
> > >
> > > What would this accomplish?  If one of the nginx machines goes down,
> > > the TCP sessions won't be able to failover to the other carp peer.
> > > I'd prefer to see in my logs which proxy a request came from so I can
> > > better diagnose if a particular machine is misbehaving.
> >
> > You're right, but we need the carp'd IP for statistics on the web
> > servers. If one of the machines goes down then the user just have to hit
> > the refresh button and she has access to the content again.
>
> Did you try to NAT the LAN interface with the carp address ? It should
> work for self outgoing traffic too. The problem is, if the connection is
> issued from the backup firewall you will lost the connection. To bypass
> this limitation, you can use ifstated and pf tables.
>
> - If the LAN interface is in master mode : add the carp address to
>   the NAT table
>
> - If the LAN interface is in backup mode : remove the carp address from
>   the nat table
>
> Claer

Thank You for all your help!

It seems that we found a workaround for this problem and we don't have to
temper with the firewall.
Mod_rpaf on the webservers will rewrite the incoming IP address.

--
Gabri Mate
gabrimate@duosol.hu
http://www.duosol.hu
Tel: 20/589-5456

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc ]