Load balance FTP (active mode) using LVS and NAT.

In active mode FTP, the FTP server responds to client requests by initiating a connection back to the client.

To load balance active FTP services, use Linux Virtual Server (LVS) via the LB Layer4 tab to perform the load balancing at layer 4. In this scenario, we define a NAT rule so that responses from servers return through HAProxy ALOHA (that is, not Direct Server Return).

Example network architecture Jump to heading #

The procedure in this section is based on an example network architecture where clients access the FTP services at the load balancer IP address 192.168.0.100. The load balancer then directs traffic to FTP servers at 192.168.1.10 and 192.168.1.11.

Enable FTP load balancing Jump to heading #

To enable HAProxy ALOHA to load balance FTP at layer 4:

1. Go to the NAT tab and click Insert to add a NAT rule. In the New Rule area, fill in the fields as described below to create a NAT rule that changes the client’s source IP to the HAProxy ALOHA appliance’s VIP.

   Field	Description
   IN	Inbound network interface. This indicates the interface of your VIP, where you receive traffic from clients.
   OUT	Outbound network interface. If your appliance has only one network interface, set this to the same as the inbound interface. If your appliance has two interfaces and one of those interfaces is in a network containing the backend servers, use that interface for OUT.
   Protocol	TCP.
   Before - Source	Leave blank or set to any, which means match any source IP address.
   Before - Source port	Leave blank or set to any, which means match any source port. Source ports are random.
   Before - Destination	The VIP address that clients connect to, to match traffic destined for that address.
   Before - Destination port	The FTP port or range. For example, set the port range 20-21.
   After - Source	The VIP address to set as the source address on incoming packets. We recommend using a VIP instead of a physical IP address so that it’s highly available between HAProxy ALOHA appliances. When you have two network interfaces, you can create a new VIP for the private network containing your real servers, to better differentiate client-facing and server-facing traffic by having two, distinct VIPs. In contrast, a physical IP address can’t be shared between the members of a cluster.
   After - Source port	Leave blank or set to same, since we won’t change the source port.
   After - Destination	Leave blank or set to same, since we won’t change the destination IP address via the NAT tab. Destination NAT is handled by LVS.
   After - Destination port	Leave blank or set to same, since we won’t change the destination port.

   Info

   In configurations having two network interfaces, if you have failover configured on one VIP, configure a VIP with failover on the other interface as well.

2. Check your configuration.

   Here’s an example NAT rule when you have one network interface.

   

3. Click Add and Apply.

4. Configure LVS on the LB Layer4 tab so that it load balances the FTP traffic between the real FTP servers. LVS performs destination NAT. Update the server lines in this example snippet to use the IP addresses of your servers. Notice that we aren’t setting an IP address on the director line, since we’ll define a flow that sends traffic to this director; it doesn’t need to listen for traffic on its own.

   haproxy
   director d_ftp
    mode nat
    balance source
    option icmpcheck interval 10
    server ftp1 <FTP real server 1 IP> weight 10 check
    server ftp2 <FTP real server 2 IP> weight 10 check

   haproxy
   director d_ftp
    mode nat
    balance source
    option icmpcheck interval 10
    server ftp1 <FTP real server 1 IP> weight 10 check
    server ftp2 <FTP real server 2 IP> weight 10 check

   Here, the FTP real servers are located at 192.168.1.10 and 192.168.1.11:

   haproxy
   director d_ftp
     mode nat
     balance source
     option icmpcheck interval 10
     server ftp1 192.168.1.10 weight 10 check
     server ftp2 192.168.1.11 weight 10 check

   haproxy
   director d_ftp
     mode nat
     balance source
     option icmpcheck interval 10
     server ftp1 192.168.1.10 weight 10 check
     server ftp2 192.168.1.11 weight 10 check

5. Click OK and then Apply.

6. Click the Flows tab to configure a flow that captures traffic sent to the VIP and sends it to the LVS director d_ftp. We do this to capture traffic destined for ports 20 and 21.

   Add this flow definition:

   haproxy
   flow f_ftp director d_ftp
     match proto tcp dst <VIP> dstport 20:21

   haproxy
   flow f_ftp director d_ftp
     match proto tcp dst <VIP> dstport 20:21

   In this example, the IP address for FTP access is 192.168.0.100.

   haproxy
   flow f_ftp director d_ftp
     match proto tcp dst 192.168.0.100 dstport 20:21

   haproxy
   flow f_ftp director d_ftp
     match proto tcp dst 192.168.0.100 dstport 20:21

   Info

   Make sure ports 20 and 21 are open on the FTP servers.

7. Click OK and then Apply.

8. To configure the flow manager service for automatic startup, go to the Services tab, locate the flowmgr service, and click Setup.

9. If the configuration contains the line no autostart, delete the line to ensure that the flow manager service starts automatically on boot.

10. Click OK and then Close.

11. Locate the flowmgr service and click Restart.

12. To ensure that packets from the same client flow to the same backend server during a session, enable LVS connection tracking. Click the Services tab, locate the lvs service, and click Setup.

13. If the configuration contains the line no autostart, delete the line to ensure that the LVS service starts automatically on boot.

14. Enable connection tracking by adding the conntrack keyword.

    text
    service lvs
      ############ Linux Virtual Server, layer 3/4 load balancing
      conntrack

    text
    service lvs
      ############ Linux Virtual Server, layer 3/4 load balancing
      conntrack

15. Click OK and then Close.

16. Locate the lvs service and click Restart.

17. To make the changes persist after a reboot, go to the Setup tab and click Save within the Configuration section.