3 ms·

Carp/ucarp are pretty fun. Additionally keepalived in linux implements vrrp and some additional nice features such as scripting what to do on failover of resour

by druiid 14y ago

Carp/ucarp are pretty fun. Additionally keepalived in linux implements vrrp and some additional nice features such as scripting what to do on failover of resources. An addendum to this guide might be to add in connection tracking across the master/slave nodes. In *BSD this is implemented with pfsync. In linux it would be iptables connection tracking. More on pfsync: http://www.openbsd.org/faq/pf/carp.html#pfsyncop http://www.openbsd.org/faq/pf/carp.html#pfsyncop Linux conntrackd: http://conntrack-tools.netfilter.org/ http://conntrack-tools.netfilter.org/ Edit: Oh, and everyone always forgets about using LVS for load-balancing and failover. There's endless documentation on the web about that, and it's not a proxy service like haproxy (which is both good and bad).

komljen 14y ago
You are right, connection tracking is must have in production environments, I will try both pfsync and iptables. Thanks
- druiid 14y ago
  Well pfsync is only for freebsd pf. If you use linux instead then you'll be using iptables + conntrackd. They're both powerful systems with a different way of thinking about the idea of packet filtering and mangling!
  - seiji 14y ago
    (pf is actually taken from openbsd and ported to freebsd every few release cycles, so pf/pfsync/carp is an openbsd-ism made available to others by the generosity of using the BSD license.)
    - X-Istence 14y ago
      The PF that is currently in 9.1 is a few releases behind from OpenBSD and most likely will stick that way because of major changes. In FreeBSD the PF is now fully multi-core aware and thus granularly locked providing a lot of extra performance, this does mean that importing the latest changes from OBSD into FBSD is going to be more difficult!
      - druiid 14y ago
        Interesting, didn't know that! How do the multi-core abilities of PF compare to how Linux handles iptables (interrupt handling, which multi-core depends on your kernel supporting it)?
        X-Istence 14y ago
        I don't know. I don't use iptables. The last time I deployed Linux was for an Android Continuous Integration server since the SDK won't run on the BSD's.

by druiid 14y ago

komljen 14y ago

You are right, connection tracking is must have in production environments, I will try both pfsync and iptables. Thanks

druiid 14y ago
Well pfsync is only for freebsd pf. If you use linux instead then you'll be using iptables + conntrackd. They're both powerful systems with a different way of thinking about the idea of packet filtering and mangling!
- seiji 14y ago
  (pf is actually taken from openbsd and ported to freebsd every few release cycles, so pf/pfsync/carp is an openbsd-ism made available to others by the generosity of using the BSD license.)
  - X-Istence 14y ago
    The PF that is currently in 9.1 is a few releases behind from OpenBSD and most likely will stick that way because of major changes. In FreeBSD the PF is now fully multi-core aware and thus granularly locked providing a lot of extra performance, this does mean that importing the latest changes from OBSD into FBSD is going to be more difficult!
    - druiid 14y ago
      Interesting, didn't know that! How do the multi-core abilities of PF compare to how Linux handles iptables (interrupt handling, which multi-core depends on your kernel supporting it)?
      - X-Istence 14y ago
        I don't know. I don't use iptables. The last time I deployed Linux was for an Android Continuous Integration server since the SDK won't run on the BSD's.