lvs ldirectord FTP 분배 설정

LVS 는 CENTOS7, FTP 서버는 rocky9

/etc/ha.d/ldirectord.cf

#  PASSIVE
virtual=12.34.56.165:21
    real=12.34.56.122:21 gate 20
    real=12.34.56.123:21 gate 20
    service=ftp
    scheduler=wlc
    netmask=255.255.255.255
    protocol=tcp
    checkport=21
    checktype=connect
    persistent=15

연결 유지 설정 15초, persistent=15 FTP 연결의 문제가 있으면 초를 더 늘리거나 한다

파일 전송 및 다운로드 가능하나 100%에서 세션이 멈춤

firewalld logging

/etc/firewalld/firewalld.conf

# Default: off
#LogDenied=off
LogDenied=all

/var/log/messages

Apr 23 20:22:03 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14539 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:04 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14540 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:04 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14542 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:04 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14543 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:05 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14544 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:07 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14545 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:10 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14546 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:17 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14547 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:30 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14548 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0
Apr 23 20:22:56 LVS1 kernel: STATE_INVALID_DROP: IN=em1 OUT= MAC=6c:3c:8c:7b:f0:a3:6c:3c:8c:7b:f0:03:08:00 SRC=12.34.56.210 DST=12.34.56.165 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=14549 DF PROTO=TCP SPT=48602 DPT=21 WINDOW=251 RES=0x00 ACK FIN URGP=0

해결책

conntrack 모듈에서 STATE INVALID PACKET 으로 간주하여 패킷이 드롭됨

LVS firewalld 설정

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 30000:31000 -m conntrack --ctstate INVALID -j ACCEPT
firewall-cmd --reload

각 FTP 서버 설정 vsftpd.conf

pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000