first step forward to merge conntrackd and conntrack into the same building chain

3 files changed, 169 insertions, 0 deletions

diff --git a/examples/sync/persistent/node2/Makefile.am b/examples/sync/persistent/node2/Makefile.am
new file mode 100644
index 0000000..edc0ed7
--- /dev/null
+++ b/examples/sync/persistent/node2/Makefile.am
@@ -0,0 +1 @@
+EXTRA_DIST = conntrackd.conf keepalived.conf 
diff --git a/examples/sync/persistent/node2/conntrackd.conf b/examples/sync/persistent/node2/conntrackd.conf
new file mode 100644
index 0000000..aee4a29
--- /dev/null
+++ b/examples/sync/persistent/node2/conntrackd.conf
@@ -0,0 +1,130 @@
+#
+# Synchronizer settings
+#
+Sync {
+	Mode PERSISTENT {
+		#
+		# If a conntrack entry is not modified in <= 15 seconds, then
+		# a message is broadcasted. This mechanism is used to
+		# resynchronize nodes that just joined the multicast group
+		#
+		RefreshTime 15
+	
+		#
+		# If we don't receive a notification about the state of 
+		# an entry in the external cache after N seconds, then
+		# remove it.
+		#
+		CacheTimeout 180
+
+		#
+		# Entries committed to the connection tracking table 
+		# starts with a limited timeout of N seconds until the
+		# takeover process is completed.
+		#
+		CommitTimeout 180
+	}
+
+	#
+	# Multicast IP and interface where messages are
+	# broadcasted (dedicated link). IMPORTANT: Make sure
+	# that iptables accepts traffic for destination
+	# 225.0.0.50, eg:
+	#
+	#	iptables -I INPUT -d 225.0.0.50 -j ACCEPT
+	#	iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT
+	#
+	Multicast {
+		IPv4_address 225.0.0.50
+		IPv4_interface 192.168.100.200 # IP of dedicated link
+		Group 3780
+		Backlog 20
+	}
+
+	# Enable/Disable message checksumming
+	Checksum on
+
+	# Uncomment this if you want to replicate just certain TCP states.
+	# This option introduces a tradeoff in the replication: it reduces
+	# CPU consumption and lost messages rate at the cost of having 
+	# backup replicas that don't contain the current state that the active 
+	# replica holds. TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED,
+	# FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE, LISTEN.
+	# 
+	# Replicate ESTABLISHED TIME_WAIT for TCP
+}
+
+#
+# General settings
+#
+General {
+	#
+	# Number of buckets in the caches: hash table
+	#
+	HashSize 8192
+
+	#
+	# Maximum number of conntracks: 
+	# it must be >= $ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
+	#
+	HashLimit 65535
+
+	#
+	# Logfile
+	#
+	LogFile /var/log/conntrackd.log
+
+	#
+	# Lockfile
+	# 
+	LockFile /var/lock/conntrack.lock
+
+	#
+	# Unix socket configuration
+	#
+	UNIX {
+		Path /tmp/sync.sock
+		Backlog 20
+	}
+
+	#
+	# Netlink socket buffer size
+	#
+	SocketBufferSize 262142
+
+	#
+	# Increase the socket buffer up to maximum if required
+	#
+	SocketBufferSizeMaxGrown 655355
+}
+
+#
+# Ignore traffic for a certain set of IP's: Usually
+# all the IP assigned to the firewall since local
+# traffic must be ignored, just forwarded connections
+# are worth to replicate
+#
+IgnoreTrafficFor {
+	IPv4_address 127.0.0.1 # loopback
+	IPv4_address 192.168.0.2
+	IPv4_address 192.168.1.2
+	IPv4_address 192.168.100.200 # dedicated link ip
+	IPv4_address 192.168.0.200 # virtual IP 1
+	IPv4_address 192.168.1.200 # virtual IP 2
+}
+
+#
+# Do not replicate certain protocol traffic 
+#
+IgnoreProtocol {
+	UDP
+	ICMP
+	IGMP
+	VRRP
+	# numeric numbers also valid
+}
+
+#
+# Strip NAT traffic
+#
+StripNAT
diff --git a/examples/sync/persistent/node2/keepalived.conf b/examples/sync/persistent/node2/keepalived.conf
new file mode 100644
index 0000000..41aa35b
--- /dev/null
+++ b/examples/sync/persistent/node2/keepalived.conf
@@ -0,0 +1,38 @@
+vrrp_sync_group G1 {   # must be before vrrp_instance declaration
+  group {
+    VI_1
+    VI_2
+  }
+  notify_master /etc/conntrackd/script_master.sh
+  notify_backup /etc/conntrackd/script_backup.sh
+}
+
+vrrp_instance VI_1 {
+    interface eth1
+    state SLAVE
+    virtual_router_id 61
+    priority 80
+    advert_int 3
+    authentication {
+      auth_type PASS
+      auth_pass papas_con_tomate
+    }
+    virtual_ipaddress {
+        192.168.0.100   # default CIDR mask is /32
+    }
+}
+
+vrrp_instance VI_2 {
+    interface eth0
+    state SLAVE
+    virtual_router_id 62
+    priority 80
+    advert_int 3
+    authentication {
+      auth_type PASS
+      auth_pass papas_con_tomate
+    }
+    virtual_ipaddress {
+        192.168.1.100
+    }
+}