The Linux Virtual Server

The Linux Virtual Server (LVS) enables the multiplexing of incoming TCP/IP connections and UDP/IP datagrams to real servers. This mechanism of connection control is often referred to as Layer 4 Switching.

Packets are received for a virtual service by the Linux Director. The scheduling algorithm decides which which real server to send the packet to. Once this decision is made subsequent packets to for the same connection will be sent to the same real server. Thus the integrity of the connection is maintained. Optionally, a service can be marked as persistent. When this is done all connections from a host will be forwarded to the same real server. This is useful for applications such as FTP where end users should consistently be directed to the same real server to ensure integrity of data connections.

Virtual Services

On the Linux Director a virtual service is defined by either an IP Address, port and protocol, or a Firewall-Mark.

• IP Address, Port and Protocol: A virtual server may be specified by:
  • An IP Address: The IP address that end users will use to access the service.
  • A port: The port that end users will connect to.
  • A protocol. Either UDP or TCP.

• Firewall-Mark: Packets may be marked with a 32-bit unsigned value using ipchains(1). The Linux Virtual Server is able to match use this mark to designate packets destined for a virtual service and route them accordingly. This is particularly useful if a large number of contiguous IP based virtual services are required with the same real servers. Or to group persistancy between different ports. For instance to ensure that a given end user is sent to the same real server for both HTTP and HTTPS.

• Direct Routing: Packets from end users are forwarded directly to the real server. The IP packet is not modified, so the real servers must be configured to accept traffic for the virtual server's IP address. This can be done using a dummy interface, or packet filtering to redirect traffic addressed to the virtual server's IP address to a local port. The real server may send replies directly back to the end user. That is if a host based layer 4 switch is used, it may not be in the return path.

• IP-IP Encapsulation: IP-IP Encapsulation or Tunnelling enables packets addressed to an IP address to be redirected to another address, possibly on a different network. In the context of layer 4 switching the behaviour is very similar to that of direct routing, except that when packets are forwarded they are encapsulated in an IP packet, rather than just manipulating the ethernet frame. The main advantage of using tunnelling is that real servers can be on a different networks.

• Network Address Translation: Network Address Translation or NAT is a method of manipulating the source and/or destination port and/or address of a packet to map networks. The most common use of this is IP Masquerading that is often used to enable RFC 1918 private networks to access the internet. In the context of layer 4 switching, packets are received from end users and the destination port and IP address are changed to that of the chosen real server. Return packets pass through the layer 4 switching device at which time the mapping is undone so the end user sees replies from the expected source.

The real servers belong to a virtual server and are defined by an IP address, a port and optionally a weight if the weighted least connected or weighted round robin scheduling algorithms are in use. In general, the port of the real servers must be the same as that of the virtual service. If firewall-mark virtual services are used then the port that an incoming connection is received on will be the port that the connection is forward to on the real server, that is the port specification for the real server is not used. The health of the real servers may be monitored using ldirectord.

Copyright © 2000-2005, Horms
Last Updated: Tue May 17 17:37:24 2005 +0900

Debian is a registered trademark of Software in the Public Interest, Inc.
Red Hat, the Red Hat Shadowman logo and Fedora are registered trademarks of Red Hat, Inc.
Red Hat may also be refered to as RedHat on this site.
Linux is a registered trademark of Linus Torvalds.
All other trademarks are the property of their respective owners.