3.4. Multi-port Services and Load Balancer LVS routers under any topology require extra configuration when creating multi-port Load Balancer services. Multi-port services can be created artificially by using firewall marks to bundle together different, but related protocols, such as HTTP (port 80) and HTTPS (port 443), or when Load Balancer is used with true multi-port protocols, such as FTP. In either case, the LVS router uses firewall marks to recognize that packets destined for different ports, but bearing the same firewall mark, should be handled identically. Also, when combined with persistence, firewall marks ensure connections from the client machine are routed to the same host, as long as the connections occur within the length of time specified by the persistence parameter. Although the mechanism used to balance the loads on the real servers, IPVS, can recognize the firewall marks assigned to a packet, it cannot itself assign firewall marks. The job of assigning firewall marks must be performed by the network packet filter, iptables . The default firewall administration tool in Red Hat Enterprise Linux 7 is firewalld , which can be used to configure iptables . If preferred, iptables can be used directly. See Red Hat Enterprise Linux 7 Security Guide for information on working with iptables in Red Hat Enterprise Linux 7. 3.4.1. Assigning Firewall Marks Using firewalld To assign firewall marks to a packet destined for a particular port, the administrator can use firewalld 's firewall-cmd utility. If required, confirm that firewalld is running: To start firewalld , enter: To ensure firewalld is enabled to start at system start: This section illustrates how to bundle HTTP and HTTPS as an example; however, FTP is another commonly clustered multi-port protocol. The basic rule to remember when using firewall marks is that for every protocol using a firewall mark in Keepalived there must be a commensurate firewall rule to assign marks to the network packets. Before creating network packet filter rules, make sure there are no rules already in place. To do this, open a shell prompt, login as root , and enter the following command: If no rich rules are present the prompt will instantly reappear. If firewalld is active and rich rules are present, it displays a set of rules. If the rules already in place are important, check the contents of /etc/firewalld/zones/ and copy any rules worth keeping to a safe place before proceeding. Delete unwanted rich rules using a command in the following format: firewall-cmd --zone= zone --remove-rich-rule=' rule ' --permanent The --permanent option makes the setting persistent, but the command will only take effect at system start. If required to make the setting take effect immediately, repeat the command omitting the --permanent option. The first load balancer related firewall rule to be configured is to allow VRRP traffic for the Keepalived service to function. Enter the following command: If the zone is omitted the default zone will be used. Below are rules which assign the same firewall mark, 80 , to incoming traffic destined for the floating IP address, n.n.n.n , on ports 80 and 443. If the zone is omitted the default zone will be used. See the Red Hat Enterprise Linux 7 Security Guide for more information on the use of firewalld 's rich language commands. 3.4.2. Assigning Firewall Marks Using iptables To assign firewall marks to a packet destined for a particular port, the administrator can use iptables . This section illustrates how to bundle HTTP and HTTPS as an example; however, FTP is another commonly clustered multi-port protocol. The basic rule to remember when using firewall marks is that for every protocol using a firewall mark in Keepalived there must be a commensurate firewall rule to assign marks to the network packets. Before creating network packet filter rules, make sure there are no rules already in place. To do this, open a shell prompt, login as root , and enter the following command: /usr/sbin/service iptables status If iptables is not running, the prompt will instantly reappear. If iptables is active, it displays a set of rules. If rules are present, enter the following command: /sbin/service iptables stop If the rules already in place are important, check the contents of /etc/sysconfig/iptables and copy any rules worth keeping to a safe place before proceeding. The first load balancer related configuring firewall rules is to allow VRRP traffic for the Keepalived service to function. Below are rules which assign the same firewall mark, 80 , to incoming traffic destined for the floating IP address, n.n.n.n , on ports 80 and 443. Note that you must log in as root and load the module for iptables before issuing rules for the first time. In the above iptables commands, n.n.n.n should be replaced with the floating IP for your HTTP and HTTPS virtual servers. These commands have the net effect of assigning any traffic addressed to the VIP on the appropriate ports a firewall mark of 80, which in turn is recognized by IPVS and forwarded appropriately. Warning The commands above will take effect immediately, but do not persist through a reboot of the system.

Commands:
systemctl status firewalld firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) Active: active (running) since Tue 2016-01-26 05:23:53 EST; 7h ago
systemctl start firewalld
systemctl enable firewalld
firewall-cmd --list-rich-rules
firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
firewall-cmd --add-rich-rule='rule family="ipv4" destination address="n.n.n.n/32" port port="80" protocol="tcp" mark set="80"' --permanent firewall-cmd --add-rich-rule='rule family="ipv4" destination address="n.n.n.n/32" port port="443" protocol="tcp" mark set="80"' --permanent firewall-cmd --reload success firewall-cmd --list-rich-rules rule protocol value="vrrp" accept rule family="ipv4" destination address="n.n.n.n/32" port port="80" protocol="tcp" mark set=80 rule family="ipv4" destination address="n.n.n.n/32" port port="443" protocol="tcp" mark set=80
/usr/sbin/iptables -I INPUT -p vrrp -j ACCEPT
/usr/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 -m multiport --dports 80,443 -j MARK --set-mark 80