[SOLVED] IPVS load ballancer can not establish TCP connection across two cluster nodes

[aasami]

Hi,
I have an IPVS direct routing Load Ballancer VM (LB) which works only when the target Backend VM (e.g. B1) is on the same cluster node.
If LB is on different node than Backend (B1), TCP connection between Client (CL) and Backend (B1) can not be established.

CL sends SYN packet to LB and LB passes it to B1.
B1 sends SYN-ACK to CL.
CL responds to LB with ACK, but this packet never arrives to LB.

When I turn off Datacenter/Cluster firewall off it works across nodes too.
I suppose ebtables might be the cause but don't know how to deal with this.

Is there a way I can use proxmox firewall and have working IPVS with direct routing mode at the same time?
With several Backend VMs it obviously doesn't make sense to have them all on one node.
Thank you anybody for some help/insight.

 

[aasami]

When noone replied, I have posted a ticket to the customer portal and here is the solution:

Enable invalid packets with nf_conntrack_allow_invalid on all cluster nodes in /etc/pve/nodes/$NODE_NAME/host.fw:

[OPTIONS]

nf_conntrack_allow_invalid: 1

Thank you Proxmox for your superb support!