Sticky connections don't work for me 20100612-0145

mxx

Hi,

according to http://redmine.pfsense.org/issues/show/337 this seems to be resolved, but I can't get it to work. Using Snapshot 20100612-0145
I have 3 wan connections. WAN0 being the default gw. WAN1 + WAN2 are grouped for load balancing.

But when I check current states there are connections from the same lan ip to the same server (http or imap in that case) 2 times. One through wan1 and second through wan2.

Could it be an issue with my traffic shaping setup?
For example my http rule under floating tab only categorizes traffic into a queue, but I didn't specify any gateway. The http rule in the LAN section is configured to using the load balancer, but no queue is specified.

Might this be causing that behavior?

Thanks!

Max

mxx

Here's an example ruleset LAN and Floating:


		 <rule><id><type>pass</type>
			<interface>lan</interface>
			 <max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
			 <os><protocol>tcp</protocol>
			<source>

<address>A_LAN</address>

			 <destination><any><port>8008</port></any></destination> 

			<gateway>LoadBalance</gateway></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></id></rule>


		 <rule><id><type>pass</type>
			 <tag><tagged><direction>out</direction>
			<floating>yes</floating>
			 <max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
			 <os><protocol>tcp</protocol>
			<source>
				 <any><destination><any><port>8080</port></any></destination> 

			<defaultqueue>qOthersLow</defaultqueue>
			<ackqueue>qACK</ackqueue></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule>

Anyone any idea why there are connections from one local address to the same external host and port utilizing both gateways in "LoadBalance" -which is my gateway group name- although sticky connections are enabled?

Thanks very much!

cmb

@mxx:

according to http://redmine.pfsense.org/issues/show/337 this seems to be resolved

No it's in feedback, which means "needs testing" - I just did and it doesn't work (related to some changes since then), it's back to new.

mxx

Thnx, just wanted to tell someone and make sure I haven't done any stupid mistakes :)