3 ms·
a) There are several load balancers that allow sharing the state tables. So if you control the network, you share/transfer state tables ahead of removing the LB
by kevin_nisbet 4y ago
a) There are several load balancers that allow sharing the state tables. So if you control the network, you share/transfer state tables ahead of removing the LB node from routing. Can even be the same IP with ECMP. I don't know how you would do this on something like an AWS network.
b) In general your right, but this is already a fairly niche use case. But I do wonder if reprogramming the conntrack entry in linux would work, or for lvs which already has a userspace daemon for state synchronization, how it would behave if reprogramming an existing state. It's at least not implausible to do that rewrite somewhere real time... if you control the edge system.
Also, again in a you control the network scenario, OpenFlow switches might allow you to reprogram the state tables while they're live.
- touisteur 4y agonetlink has all you need https://github.com/tgraf/libnl/blob/master/src/nf-ct-add.c https://github.com/tgraf/libnl/blob/master/src/nf-ct-add.c The Linux kernel stack is crazy.
- leohonexus 4y agoFor conntrack, one possibility might be to bypass conntrack on incoming connections using `iptables -j NOTRACK`, effectively making the firewall stateless.