1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Floating/Virtual IP for redundancy and/or load balance

Discussion in 'Tomato Firmware' started by eangulus, Feb 11, 2018.

  1. eangulus

    eangulus Network Guru Member

    Hi,

    We currently run 2 Synology NAS's in duplicate for redundancy. We have been running them under Synology High Availability, but have had issues. Twice in the past 6 months the HA has failed to do its job and now we no longer trust it. Also it was an Active Slave config with no option for an Active Active. To me this seemed a waste of resources.

    I have now setup both NAS's seperatly but identical, and have managed to get. 2 way live sync which so far works quite well.

    This issue now is that if the main unit fails, I will need to change over IP address to bring the slave unit into service.

    So to solve this I was wondering if there was something I could do on my RT-AC3200 running kille tomato firmware.

    So in order of minimum to dream setup:

    Is there a way either via NAT or scripting where I can have a virtual IP address that can be pointed to the real IP address to ease switching the units.

    Or a way to have a virtual/floating IP that will check for the real IP and connect to the live one, making switchover automatic.

    And is there a way it could possibly split load between the units either automatically or hard code up ranges to use each NAS for example send office traffic to NAS 1 and security camera storage to NAS 2 therefore giving us an Active Active setup.

    PS: I don't know allot about NAT routing but can work out basic things. I am not afraid to get my hands dirty either with working this out.

    I figured that seeing I can run a VPN and direct particular IP addresses and particular ports over it while bypassing others, my request seems very basic in comparison, so figured it should be possible.

    Sent from my Pixel XL using Tapatalk
     
  2. eibgrad

    eibgrad Network Guru Member

    Biggest problem at the moment is that the router never gets involved in LAN to LAN traffic. For LAN to LAN traffic, you don't even need a router; a switch will suffice.

    One way to get the router involved in LAN to LAN traffic is to trick the clients into believing the target (NAS) lies outside its own IP network, then route it back into the same network using NAT (specifically DNAT), aka NAT loopback.

    IOW, it looks to all your clients that a given resource is remote, and therefore they always access it via their default gateway. And now you have the opportunity to manipulate the traffic at the router. So you could, for example, change the DNAT from one device to another without the client even being aware of it. Now how easy it would be to have the router play the role of "monitor" or "traffic cop" is an open question. Usually these things are done statically, not dynamically.
     
  3. eangulus

    eangulus Network Guru Member

    Thanks for the info there. Great help in my research (not giving up on this).

    I have been researching and I found some stuff regarding floating IP and maybe load balancing using HAProxy or Nginx. Seeing the latter is built in, could I maybe set something up from there? Or maybe need to setup a HAProxy VM...

    Sent from my Pixel XL using Tapatalk
     
  4. eangulus

    eangulus Network Guru Member

    Is it possible for someone to add VRRP to Tomato? VRRP seems to be the feature I need to be able to do this (from what I was told by a guy who does enterprise networks)
     
  5. eibgrad

    eibgrad Network Guru Member

    Normally the avenue for additional features is optware/entware. I checked entware and didn't see it.
     
  6. lancethepants

    lancethepants Network Guru Member

    Yim Sonny likes this.
  7. lancethepants

    lancethepants Network Guru Member

    Yim Sonny likes this.
  8. eangulus

    eangulus Network Guru Member

    Sorry just saw your messages, and thanks for the compile.

    Just read up on ucarp and it's exactly what I need. My only issue is that it seems to need a client. While that is fine for some things I can use this for, eg. Apache server, for the purpose that started this quest it will be for 2 Synology NAS units. I am unsure if it's possible to even install ucarp on these let alone run the scripts described in the readme.

    Sent from my Pixel XL using Tapatalk
     
  9. Sean B.

    Sean B. LI Guru Member

    Perhaps there's a reason this wouldn't suit your needs, as I didn't thoroughly read every post: Why not put the two NAS's in their own VLAN/subnet? You can then use iptables to redirect traffic to either/or at will. Depending on how exactly the NAS's "fail" ( completely unresponsive in regards to the network, or just the file storage read/write fails etc ) a script for failover between the two shouldn't take much effort. The script would be extremely easy if they stop responding to pings.
     
  10. eangulus

    eangulus Network Guru Member

    IP Tables is was what I originally thought I would be doing, but I have yet to find an example I can adapt. I'm not good enough with iptables to write one from scratch but I usually can modify to suit my needs.

    To give more background (in case of another solution):

    We had 2 Synology NAS units that were setup with Synology's built in HA. All writes were copied to the second unit and it had a heartbeat connection between them. They would failover when the master failed.

    Twice now, we did firmware updates following Synology's instructions to the letter, and both times the HA Failed. First time wasn't too bad just had to resynchronization and setup HA. Second time thou we ended up with a dead unit and a corrupted system on the other. Needless to say we no longer trust Synology's HA solution.

    So I have been testing out some options. I have managed to make work a 2 way sync between the 2. I write data to either unit and the other instantly gets a copy. This is good as we can have failover without the systems relying on each other. If one fails we just don't have the second copy. Our other issue with Synology's HA is that it is an Active Passive setup. We have the resources of 2 units and the cost, but can only utilise one unit at a time.

    By doing the 2 way sync, at this stage means it is a manual failover. If the primary one fails, then I just have to modify IP address on the second and we're back.

    Ideally thou, I would like a floating IP that will auto failover between 2 real IP's. Even better would be a load balance between the IPs. This way we can have an Active Active setup.

    I can get ucarp to work by setting up 2 Linux VMs and mapping each NAS to each and share via samba. Then I can utilise ucarp for failover between them. But that isn't and active active setup and it isn't overly elegant.

    PS: the NAS's are in their own Subnet.
     
  11. Sean B.

    Sean B. LI Guru Member

    If they're in their own subnet/VLAN ( in relation to the clients that access them. IE: Clients are on 192.168.1.X/vlan1/br0 and NAS's are on 192.168.2.X/vlan3/br1 ) then all need be done is write a script to monitor the state of the NAS's and redirect traffic accordingly. When one of your NAS's " fails " .. does it lose network connectivity completely? I need to establish the failure mode in order to implement monitoring correctly in a script.
     
  12. eangulus

    eangulus Network Guru Member

    Not sure of the failure mode. Most important obviously is SAMBA shares. Obviously if network drops we loose samba too. But not sure what to do if network stays (and responded to pings) while samba dies.

    Sent from my Pixel XL using Tapatalk
     
  13. Sean B.

    Sean B. LI Guru Member

    Well, there's 2 methods that come to mind we can use to monitor the samba connectivity specifically. One would be that you install optware-ng/entware so add-on packages can be installed, namely smbclient that we can use via the script to check available shared directories from the NAS's as a confirmation they're still active. Or, use the current CIFS functionality in Tomato to mount a share from each NAS into a directory on the router. The script could then read/write to those directories to confirm they're still active.
     
  14. eangulus

    eangulus Network Guru Member

    Just not sure I can install optware etc to Synology. Can we just check the cifs already running on the Nas for available shares?

    Sent from my Pixel XL using Tapatalk
     
  15. Sean B.

    Sean B. LI Guru Member

    Not installed on the Synology, install on a USB flash/HDD of which you leave plugged into the Tomato router.

    In Tomato, the only CIFS functionality is to mount a remote share to a directory on the router. There's no scanning for available shares from a host on the network etc as there is with Samba. It will add more to the script, and more to deal with on the back end compared to just running optware and using smbclient. However, if you wish not to just install optware ( it's an easy process, and provides access to many software packages you may find useful down the road ) we can deal with CIFS.
     
    Last edited: Feb 20, 2018 at 6:14 AM
  16. eangulus

    eangulus Network Guru Member

    Ok I think I understand better. Not sure what way to do it thou, never used optware before so completely new to that. Have scripted before (I have a custom VPN script directing traffic from a server only over it).

    I am just looking for the easiest but most reliable and elegant way to go about it, so open to suggestions.

    BTW: Does this ucarp method able to load balance? My perfect setup would be the floating IP and load balance but with the ability to direct certain subnets to a particular Nas. For example I could direct IP cameras to a particular Nas while loadbalancing all other traffic. Something like how the multiwan works were you set a weight etc as well. Also is it possible for a 3rd device in the floating IP setup? I am also thinking about using a floating IP for other devices to like our VM's where I can duplicate the VM to another server and have redundancy there too.

    Sent from my Pixel XL using Tapatalk
     

Share This Page