Hi all,
I am having an issue with HTTPS traffic during a failover. All of my loadbalance groups failover correctly except the HTTP one.
Group LOWLATENCY
interface : eth1
carrier : up
status : active
gateway : 176.26.136.1
route table : 202
weight : 100%
flows
WAN Out : 142000
WAN In : 0
Local Out : 15130
interface : eth0
carrier : up
status : failover
gateway : unknown
route table : 201
weight : 0%
flows
WAN Out : 0
WAN In : 40
Local Out : 0
Group STICKY
interface : eth0
carrier : up
status : inactive
gateway : unknown
route table : 203
weight : 0%
flows
WAN Out : 40528
WAN In : 0
Local Out : 0
interface : eth1
carrier : up
status : active
gateway : 86.12.228.11
route table : 204
weight : 100%
flows
WAN Out : 29343
WAN In : 0
Local Out : 0
Group WLB
interface : eth0
carrier : up
status : inactive
gateway : unknown
route table : 205
weight : 0%
flows
WAN Out : 140000
WAN In : 0
Local Out : 0
interface : eth1
carrier : up
status : active
gateway : 176.26.136.1
route table : 206
weight : 100%
flows
WAN Out : 50840
WAN In : 0
Local Out : 0
As you can see the STICKY group shows up as "inactive" and has the failed interfaces gateway IP address. It should IMHO show the other gateway and the status should read "failover"
My full config is here
firewall {
all-ping enable
broadcast-ping disable
group {
port-group GAMES_TCP {
description "Game TCP ports"
port 1119
port 3724
port 6113
port 5222
port 9988
port 17502
port 20000-20100
port 22990
port 42127
}
port-group GAMES_UDP {
description "Game UDP ports"
port 3659
port 6250
port 5062
port 5060
port 12000-64000
port 3478
port 3479
port 1119
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
modify WLB {
rule 20 {
action modify
destination {
group {
address-group ADDRv4_eth0
}
}
modify {
table main
}
}
rule 21 {
action modify
destination {
group {
address-group ADDRv4_eth1
}
}
modify {
table main
}
}
rule 22 {
action modify
destination {
address 192.168.101.0/24
}
modify {
table main
}
}
rule 29 {
action modify
destination {
port 443
}
modify {
lb-group STICKY
}
protocol tcp
}
rule 30 {
action modify
description "Low latency TCP LB rule"
destination {
group {
port-group GAMES_TCP
}
}
modify {
lb-group LOWLATENCY
}
protocol TCP
}
rule 31 {
action modify
description "Low latency UDP LB rule"
destination {
group {
port-group GAMES_UDP
}
}
modify {
lb-group LOWLATENCY
}
protocol UDP
}
rule 100 {
action modify
modify {
lb-group WLB
}
}
}
name WAN_IN {
default-action drop
description "From internet to LAN"
rule 10 {
action accept
description "Allow established sessions"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 20 {
action accept
description "Plex inbound for NAT"
destination {
address 192.168.1.254
port 32400
}
protocol tcp
}
rule 30 {
action drop
description "Drop invalid state"
log disable
protocol all
}
}
name WAN_LOCAL {
default-action drop
description ""
rule 1 {
action accept
description "Allow established sessions"
log disable
protocol all
state {
established enable
invalid disable
new disable
related enable
}
}
rule 2 {
action drop
description "Drop invalid state"
log disable
protocol all
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address dhcp
description VM_WAN
dhcp-options {
default-route update
default-route-distance 210
name-server no-update
}
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
poe {
output off
}
speed auto
}
ethernet eth1 {
address dhcp
description SKY_WAN
dhcp-options {
client-option "send dhcp-client-identifier **"
default-route update
default-route-distance 210
name-server no-update
}
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
poe {
output off
}
speed auto
}
ethernet eth2 {
duplex auto
poe {
output off
}
speed auto
}
ethernet eth3 {
description WLAN
duplex auto
poe {
output 48v
}
speed auto
}
ethernet eth4 {
description LAN
duplex auto
poe {
output off
}
speed auto
}
loopback lo {
}
pseudo-ethernet peth1 {
address 192.168.101.1/24
description "Openreach Modem"
link eth1
}
switch switch0 {
address 192.168.1.1/24
firewall {
in {
modify WLB
}
}
mtu 1500
switch-port {
interface eth2 {
}
interface eth3 {
}
interface eth4 {
}
vlan-aware disable
}
}
}
load-balance {
group LOWLATENCY {
interface eth0 {
failover-only
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
}
interface eth1 {
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
}
lb-local disable
}
group STICKY {
interface eth0 {
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
weight 75
}
interface eth1 {
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
weight 25
}
lb-local disable
sticky {
dest-addr enable
proto enable
source-addr enable
}
}
group WLB {
interface eth0 {
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
weight 75
}
interface eth1 {
route-test {
initial-delay 60
interval 10
type {
ping {
target 8.8.8.8
}
}
}
weight 25
}
lb-local disable
sticky {
}
}
}
protocols {
static {
interface-route 192.168.100.0/24 {
next-hop-interface eth0 {
description SuperHub
distance 1
}
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LANSubnet1 {
authoritative disable
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 192.168.1.1
lease 86400
start 192.168.1.10 {
stop 192.168.1.254
}
static-mapping HomeServer {
ip-address 192.168.1.254
mac-address 44:8a:5b:99:75:92
}
static-mapping Vera {
ip-address 192.168.1.60
mac-address 94:4a:0c:08:4e:8e
}
unifi-controller 192.168.1.254
}
}
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on switch0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 10 {
destination {
port 32400
}
inbound-interface eth0
inside-address {
address 192.168.1.254
port 32400
}
protocol tcp
type destination
}
rule 11 {
destination {
port 32400
}
inbound-interface eth1
inside-address {
address 192.168.1.254
port 32400
}
protocol tcp
type destination
}
rule 5001 {
description "VM WAN NAT"
log disable
outbound-interface eth0
protocol all
type masquerade
}
rule 5002 {
description "SKY WAN NAT"
log disable
outbound-interface eth1
protocol all
type masquerade
}
rule 5003 {
description "Openreach Modem"
log disable
outbound-interface peth1
protocol all
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
}
system {
conntrack {
expect-table-size 4096
hash-size 4096
table-size 32768
tcp {
half-open-connections 512
loose enable
max-retrans 3
}
}
host-name HomeRouter
login {
user admin {
authentication {
encrypted-password ****************
plaintext-password ****************
}
level admin
}
}
name-server 8.8.8.8
name-server 8.8.4.4
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat disable
ipsec enable
ipv4 {
forwarding enable
}
ipv6 {
forwarding disable
}
}
package {
repository debian {
components main
distribution wheezy
password ****************
url http://ftp.us.debian.org/debian
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/London
traffic-analysis {
dpi enable
export enable
}
}
traffic-control {
}Does anyone have any ideas?
Thank you!
