Installation guide

Chapter 9. Setting Up a Red Hat Enterprise Linux LVS Cluster 111
9.4.3. Creating Network Packet Filter Rules
Before assigning any iptables rules for FTP service, review the information in
Section 9.3.1 Assigning Firewall Marks concerning multi-port services and techniques for
checking the existing network packet filtering rules.
Below are rules which assign the same firewall mark, 21, to FTP traffic. For these rules to
work properly, you must also use the VIRTUAL SERVER subsection of Piranha Con-
figuration Tool to configure a virtual server for port 21 with a value of 21 in the Firewall
Mark field. See Section 10.6.1 The VIRTUAL SERVER Subsection for details.
9.4.3.1. Rules for Active Connections
The rules for active connections tell the kernel to accept and forward connections coming
to the internal floating IP address on port 20 — the FTP data port.
iptables
/sbin/iptables -t nat -A POSTROUTING -p tcp \
-s n.n.n.0/24 --sport 20 -j MASQUERADE
In the above iptables commands, n.n.n should be replaced with the first three val-
ues for the floating IP for the NAT interface’s internal network interface defined in the
GLOBAL SETTINGS panel of Piranha Configuration Tool. The command allows the
LVS router to accept outgoing connections from the real servers that IPVS does not know
about.
9.4.3.2. Rules for Passive Connections
The rules for passive connections assign the appropriate firewall mark to connections com-
ing in from the Internet to the floating IP for the service on a wide range of ports — 10,000
to 20,000.
Warning
If you are limiting the port range for passive connections, you must also configure the
VSFTP server to use a matching port range. This can be accomplished by adding the
following lines to /etc/vsftpd.conf:
pasv_min_port=10000
pasv_max_port=20000
You must also control the address that the server displays to the client for passive FTP
connections. In a NAT routed LVS system, add the following line to /etc/vsftpd.conf
to override the real server IP address to the VIP, which is what the client sees upon
connection. For example: