Active FTP

Example network architecture

The procedures in this section are based on an example network architecture where clients access the FTP services at the load balancer IP address 192.168.0.100. The load balancer then directs traffic to FTP servers at 192.168.1.10 and 192.168.1.11.

Configure source NAT

Create a NAT rule to translate the client's source IP to the HAProxy ALOHA appliance's IP.

1. In the NAT tab, click Insert to add a new NAT rule.

2. The values you enter in the New Rule area depend on the number of network interfaces attached to HAProxy ALOHA.

   • One network interface

     --------+-------- 192.168.1.0/24, VIPs, backend servers
             |
             | eth0
        +---------+
        |         |
        |  ALOHA  |
        |         |
        +---------+

     In a deployment with one network interface, select the following values in the New Rule area.

     Field	Description
     IN	Inbound network interface
     OUT	Outbound network interface, the same as the inbound interface
     Protocol	TCP

   • Two network interfaces

     --------+-------- 192.168.1.0/24, VIPs
             |
             | eth0
        +---------+
        |         |
        |  ALOHA  |
        |         |
        +---------+
             | eth1
             |
     --------+-------- 192.168.2.0/24, backend servers

     In a deployment with two network interfaces, select the following values in the New Rule area.

     Field	Description
     IN	Inbound network interface
     OUT	Outbound network interface, different from the inbound interface
     Protocol	TCP

3. Enter the following values in the Before area.

   Field	Value	Example
   Source	Blank
   Source port	Blank
   Destination	VIP address	192.168.0.100
   Destination port	FTP port or range	20-21

4. Enter the following values in the After area.

   Field	Value	Example
   Source	VIP address	192.168.0.100
   Source port	Blank
   Destination	Blank
   Destination port	Blank

5. Check your configuration.

   Rule for one network interface.

   

6. Click Add and Apply.

7. On the Setup tab, in the Configuration section, click Save.

Configure LVS load balancer and destination NAT

Define the LVS director d_ftp, which load balances the FTP traffic between the real FTP servers. LVS performs destination NAT.

1. Click the LB Layer4 tab.

2. Add this configuration:

   director d_ftp
     mode nat
     balance source
     option icmpcheck interval 10
     server ftp1 <FTP real server 1 IP> weight 10 check
     server ftp2 <FTP real server 2 IP> weight 10 check

   In the example, the FTP real servers are located at 192.168.1.10 and 192.168.1.11.

   director d_ftp
      mode nat
      balance source
      option icmpcheck interval 10
      server ftp1 192.168.1.10 weight 10 check
      server ftp2 192.168.1.11 weight 10 check

3. Click OK and then Apply.

4. Click on the Setup tab. In the Configuration section, click Save.

Configure a flow

Configure a flow that captures traffic sent to the VIP and sends it to the LVS director d_ftp:

1. Click the Flows tab.

2. Add this flow definition:

   flow f_ftp director d_ftp
     match proto tcp dst <VIP> dstport 20:21

   The example IP address for FTP access is 192.168.0.100.

   flow f_ftp director d_ftp
      match proto tcp dst 192.168.0.100 dstport 20:21

3. Click OK and then Apply.

4. Click on the Setup tab. In the Configuration section, click Save.

Configure the flow manager service

Configure the flow manager service for automatic startup:

1. On the Services tab, locate the flowmgr service and click Setup .

2. If the configuration contains the line no autostart, delete the line.

3. Click OK and then Close.

4. Locate the flowmgr service and click Restart .

5. Click on the Setup tab. In the Configuration section, click Save.

Configure the LVS service

Configure the LVS service for automatic startup and connection tracking. NAT relies on the connection tracking information so that it can translate all of the packets in a session in the same way.

1. On the Services tab, locate the lvs service and click Setup .

2. If the configuration contains the line no autostart, delete the line.

3. Enable connection tracking by adding the conntrack keyword.

   service lvs
     ############ Linux Virtual Server, layer 3/4 load balancing
     conntrack

4. Click OK and then Close.

5. Locate the lvs service and click Restart .

6. On the Setup tab, in the Configuration section, click Save.