3.5.3. Creating Network Packet Filter Rules
Below are rules which assign the same firewall mark, 21, to FTP traffic. For these rules to work properly, you must also use the VIRTUAL SERVER
subsection of Piranha Configuration Tool
to configure a virtual server for port 21 with a value of
in the Firewall Mark
field. See Section 4.6.1, “The VIRTUAL SERVER Subsection”
126.96.36.199. Rules for Active Connections
The rules for active connections tell the kernel to accept and forward connections coming to the internal floating IP address on port 20 — the FTP data port.
iptables command allows the LVS router to accept outgoing connections from the real servers that IPVS does not know about:
/sbin/iptables -t nat -A POSTROUTING -p tcp -s
n.n.n.0/24 --sport 20 -j MASQUERADE
n.n.n should be replaced with the first three values for the floating IP for the NAT interface's internal network interface defined in the GLOBAL SETTINGS panel of Piranha Configuration Tool.