Red Hat CLUSTER SUITE - CONFIGURING AND MANAGING A CLUSTER 2006 Manual page 127

Chapter 9. Setting Up a Red Hat Enterprise Linux LVS Cluster
9.4.3.1. Rules for Active Connections
The rules for active connections tell the kernel to accept and forward connections coming
to the internal floating IP address on port 20 — the FTP data port.
iptables
/sbin/iptables -t nat -A POSTROUTING -p tcp \
-s n.n.n.0/24 --sport 20 -j MASQUERADE
In the above
iptables
ues for the floating IP for the NAT interface's internal network interface defined in the
GLOBAL SETTINGS panel of Piranha Configuration Tool. The command allows the
LVS router to accept outgoing connections from the real servers that IPVS does not know
about.
9.4.3.2. Rules for Passive Connections
The rules for passive connections assign the appropriate firewall mark to connections com-
ing in from the Internet to the floating IP for the service on a wide range of ports — 10,000
to 20,000.
Warning
If you are limiting the port range for passive connections, you must also configure the
VSFTP server to use a matching port range. This can be accomplished by adding the
following lines to
pasv_min_port=10000
pasv_max_port=20000
You must also control the address that the server displays to the client for passive FTP
connections. In a NAT routed LVS system, add the following line to
to override the real server IP address to the VIP, which is what the client sees upon
connection. For example:
pasv_address=X.X.X.X
Replace X.X.X.X with the VIP address of the LVS system.
For configuration of other FTP servers, consult the respective documentation.
This range should be a wide enough for most situations; however, you can increase this
number to include all available non-secured ports by changing
mands below to
1024:65535
commands, n.n.n should be replaced with the first three val-
:
/etc/vsftpd.conf
.
/etc/vsftpd.conf
in the com-
10000:20000
111