carp+pfsync+freevrrpd+jail

[Dmitriy Kirhlarov]

Hi!

First of all.  If you're using carp, you need ports/net/ifstated, not
freevrrpd.

On Thu, Jul 06, 2006 at 11:46:18PM +0400, Anton Nikiforov wrote:

> What i have is that when i'm pinging carp0 (inet) or carp1(lan)
> interface's ip address of my firewall - i'm receivind DUP responses.

One from carp and other from freevrrpd.

> And when host2 is ths slave and i'm starting to ping carp0 address -
> no traffic appears on master host - that means that the local carp
> interface responding to my packets..

Yep. Full standby mode (backup don't have shared IP) is not
implemented now.

> That means that in case some service (provided by jail managed by
> freevrrpd) will be accessed from outside - i cannot be sure what
> host will answer the request.

I don't understand your idea. Do you want to start-stop jail, when
master node is down-up?

> I have done some tests. When i'm sshing to virtual IP - sometimes
> i'm getting ssh prompt and can login, and sometimes it says that
> host auth info is bad (yes, because second server answering me at
> this time) and sometimes i'm loosing ssh connection while session is
> active.

Use 'advbase' and 'advskew' params on both hosts for hard managing
status of nodes.

> No ballance needed. I want to have some service run in main OS, some
> services run in jail and i want to be sure which host will answer
> the request when bouth hosts are up and running.

Be careful, if you want to use carp IP inside jail. Only master node can
get data from external world.
I tried to make this schema:
           ldap1
	  /    \
       ldapn1   ldapn2
       | | |    | | |
      clients  clients

Where ldap1 -- master ldap server.
ldapn1, ldapn2 -- jail on different hosts on carp shared IP. They
connect to ldap1 and get fresh data from master ldap server.

I found, that only master node can start successfully. Jail on backup
node can't start, because ldap server can't start. It can't start,
because, it can't successfully connect to ldap1.
ldapn2 sends SYN, ldap1 returns SYN+ACK, and switch delivers this
packet to ldapn1 -- active master node.
In order to have this schema working, both nodes must have personal IP
and shared IP, but it's impossible within current jail implementation.

WBR
-- 
Dmitriy Kirhlarov
OILspace, 26 Leninskaya sloboda, bld. 2, 2nd floor, 115280 Moscow, Russia
P:+7 495 105 7247 ext.203 F:+7 495 105 7246 E:DmitriyKirhlarov at oilspace.com
OILspace - The resource enriched - www.oilspace.com