Page MenuHomeVyOS Platform
Create Task
Maniphest T4904

Allow multiple ports for high-availability virtual-server
Closed, ResolvedPublicFEATURE REQUEST
Actions

Description

Allow multiple ports for high-availability virtual-server
Request from the forum
The current implementation allows using only one "virtual" port and several real servers ports

set high-availability virtual-server 203.0.113.1 port '8888'
set high-availability virtual-server 203.0.113.1 protocol 'tcp'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 port '80'

The syntax can be with rules:

set high-availability virtual-server 203.0.113.1 rule 10 port '8280'
set high-availability virtual-server 203.0.113.1 rule 10 protocol 'tcp'
set high-availability virtual-server 203.0.113.1 rule 10 real-server 192.0.2.11 port '80'
set high-availability virtual-server 203.0.113.1 rule 10 real-server 192.0.2.12 port '80'
set high-availability virtual-server 203.0.113.1 rule 20 port '443'
set high-availability virtual-server 203.0.113.1 rule 20 protocol 'tcp'
set high-availability virtual-server 203.0.113.1 rule 20 real-server 192.0.2.11 port '443'
set high-availability virtual-server 203.0.113.1 rule 20 real-server 192.0.2.12 port '443'

keepalive config

# Virtual-server configuration
virtual_server 203.0.113.1 8280 {
    delay_loop 10
    lb_algo lc
    lb_kind NAT
    persistence_timeout 300
    protocol TCP
    real_server 192.0.2.11 80 {
        weight 1
        TCP_CHECK {
        }
    }
    real_server 192.0.2.12 80 {
        weight 1
        TCP_CHECK {
        }
    }
}

virtual_server 203.0.113.1 443 {
    delay_loop 10
    lb_algo lc
    lb_kind NAT
    persistence_timeout 300
    protocol TCP
    real_server 192.0.2.11 443 {
        weight 1
        TCP_CHECK {
        }
    }
    real_server 192.0.2.12 443 {
        weight 1
        TCP_CHECK {
        }
    }
}

Other options that can be improved:

  • all ports (port 0)
  • fwmark
virtual_server 1.2.3.11 0 {
    delay_loop 6
    lb_algo wlc
    lb_kind NAT
    nat_mask 255.255.255.0
    persistence_timeout 0
    protocol TCP
    real_server 1.2.3.5 0 {
        weight 1
        inhibit_on_failure
        MISC_CHECK {
            misc_path /usr/local/bin/check_both_http_and_http.sh 1.2.3.5
        }
    }
}

Or :

virtual_server fwmark 14 {
    delay_loop 6
    lb_algo wlc
    lb_kind NAT
    nat_mask 255.255.255.0
    persistence_timeout 0
    protocol TCP
    real_server 1.2.3.5 0 {
        weight 1
        inhibit_on_failure
        MISC_CHECK {
            misc_path /usr/local/bin/check_both_http_and_http.sh 1.2.3.5
        }
    }
}

For packet marking:

set policy route PR interface 'eth0'
set policy route PR rule 10 destination address '203.0.113.1'
set policy route PR rule 10 destination port '80,8080,443,8888'
set policy route PR rule 10 protocol 'tcp'
set policy route PR rule 10 set mark '111'

set high-availability virtual-server 203.0.113.1 fwmark 111
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '0'

Details

Difficulty level
Normal (likely a few hours)
Version
1.4
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Event Timeline

Viacheslav created this task.Jan 2 2023, 11:31 AM
Viacheslav updated the task description. (Show Details)Jan 2 2023, 11:45 AM
Viacheslav changed Difficulty level from Unknown (require assessment) to Normal (likely a few hours).
Viacheslav changed Version from - to 1.4.
Viacheslav updated the task description. (Show Details)Jan 2 2023, 12:51 PM
Viacheslav updated the task description. (Show Details)
Viacheslav changed the task status from Open to In progress.Jan 2 2023, 2:21 PM
Viacheslav claimed this task.
pasik added a subscriber: pasik.Jan 2 2023, 4:32 PM
Viacheslav added a comment.Jan 2 2023, 7:09 PM

PR https://github.com/vyos/vyos-1x/pull/1735

set interfaces ethernet eth0 address '192.0.2.1/24'
set interfaces ethernet eth0 description 'LAN'
set interfaces ethernet eth4 address 'dhcp'
set interfaces ethernet eth4 description 'WAN'

set policy route PR interface 'eth4'
set policy route PR rule 10 destination port '80,2222,8888'
set policy route PR rule 10 protocol 'tcp'
set policy route PR rule 10 set mark '111'

set high-availability virtual-server 203.0.113.1 fwmark '111'
set high-availability virtual-server 203.0.113.1 protocol 'tcp'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check script '/bin/true'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '0'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 health-check script '/bin/true'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 port '0'

set nat source rule 100 outbound-interface 'eth4'
set nat source rule 100 source address '192.0.2.0/24'
set nat source rule 100 translation address 'masquerade'

keepalive configuration:

vyos@r1# cat /run/keepalived/keepalived.conf 
# Autogenerated by VyOS
# Do not edit this file, all your changes will be lost
# on next commit or reboot

global_defs {
    dynamic_interfaces
    script_user root
    notify_fifo /run/keepalived/keepalived_notify_fifo
    notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
}



# Virtual-server configuration
# Vserver 203.0.113.1
virtual_server fwmark 111 {
    delay_loop 10
    lb_algo lc
    lb_kind NAT
    persistence_timeout 300
    protocol TCP
    real_server 192.0.2.11 0 {
        weight 1
        MISC_CHECK {
            misc_path /bin/true
        }
    }
    real_server 192.0.2.12 0 {
        weight 1
        MISC_CHECK {
            misc_path /bin/true
        }
    }
}
[edit]
vyos@r1# 
[edit]
vyos@r1# 
[edit]
vyos@r1# run show virtual-server 
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
FWM  111 lc persistent 300
  -> 192.0.2.11:0                 Masq    1      0          0         
  -> 192.0.2.12:0                 Masq    1      1          0
[edit]
vyos@r1#
Viacheslav closed this task as Resolved.Jan 5 2023, 7:34 AM
Viacheslav moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.