Load Balancing with nftables by Laura Garca (Zen Load Balancer Team) - - PowerPoint PPT Presentation

▶
load balancing with nftables
SMART_READER_LITE
LIVE PREVIEW

Load Balancing with nftables by Laura Garca (Zen Load Balancer Team) - - PowerPoint PPT Presentation

Jan 02, 2023 897 likes •1.31k views

Load Balancing with nftables by Laura Garca (Zen Load Balancer Team) Netdev 1.1 Prototype of Load Balancing with nftables Goal: High Performance Load Balancer Load Balancing Solutions Load Balancing Solutions Linux Virtual Server

slide-1
SLIDE 1

Load Balancing with nftables

by Laura García (Zen Load Balancer Team) Netdev 1.1

slide-2
SLIDE 2

Prototype of Load Balancing with nftables

slide-3
SLIDE 3

Goal: High Performance Load Balancer

slide-4
SLIDE 4

Load Balancing Solutions

slide-5
SLIDE 5

Load Balancing Solutions

Linux Virtual Server iptables nftables

slide-6
SLIDE 6

Load Balancing Solutions - LVS

  • Feature complete & versatile schedulers
  • Several forwarding methods
  • Integrated health checks
  • Built on top of netfilter
  • Mostly kernel code base
slide-7
SLIDE 7

Load Balancing Solutions - iptables

  • Schedulers based on xtables extensions
  • SNAT and DNAT as forwarding methods
  • Mark packets and forwarding
  • Backend health checks from user space
slide-8
SLIDE 8

Load Balancing Solutions - iptables

ruleset mng & health daemon

BACKEND 0 BACKEND 1

prerouting mangle prerouting nat

check_ping, check_tcp, check_http, ...

iptables

load balancer

user space kernel space

pkt

(1st Approach)

slide-9
SLIDE 9

Load Balancing Solutions - nftables

  • Using nftables infrastructure

○ nft libraries ○ nftables VM & its instructions

  • Dynamic and atomic rules
  • No marking packets needed
  • Several forwarding methods
slide-10
SLIDE 10

Load Balancing Solutions - nftables

ruleset mng & health daemon

BACKEND 0 BACKEND 1

prerouting nat

check_ping, check_tcp, check_http, ...

load balancer

user space kernel space

pkt

nftables script

slide-11
SLIDE 11

Features to accomplish

slide-12
SLIDE 12

Features to accomplish

Schedulers

round robin, weight, least connections

slide-13
SLIDE 13

Features to accomplish

Persistence

Source IP

slide-14
SLIDE 14

Features to accomplish

Forwarding methods

SNAT, DNAT

slide-15
SLIDE 15

Features to accomplish

Health checks

Backend monitoring in user space at different levels

slide-16
SLIDE 16

Features to accomplish

Good Integration

QoS, filtering

slide-17
SLIDE 17

Use Cases

slide-18
SLIDE 18

Use Cases

Round Robin Load Balancing with LVS

ipvsadm -A -t 192.168.0.40:80 -s rr ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.10:80 -m ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.11:80 -m

BACKEND 0 BACKEND 1 LB

pkt

192.168.0.40:80 192.168.100.11:80 192.168.100.10:80

slide-19
SLIDE 19

Use Cases

Round Robin Load Balancing with IPT

iptables -t nat -A PREROUTING -m statistic --mode nth --every 2 --packet 0 -d 192.168.0.40 -p tcp --dport 80 -j DNAT --to-destination 192.168.100.10:80 iptables -t nat -A PREROUTING -m statistic --mode nth --every 2 --packet 1 -d 192.168.0.40 -p tcp --dport 80 -j DNAT --to-destination 192.168.100.11:80

BACKEND 0 BACKEND 1 LB

pkt

192.168.0.40:80 192.168.100.11:80 192.168.100.10:80

slide-20
SLIDE 20

Use Cases

Round Robin Load Balancing with NFT

table ip lb { chain prerouting { type nat hook prerouting priority 0; policy accept; ip daddr 192.168.0.40 tcp dport http dnat nth 2 map { 0: 192.168.100.10, 1: 192.168.100.11 } } }

BACKEND 0 BACKEND 1 LB

pkt

192.168.0.40:80 192.168.100.11:80 192.168.100.10:80

slide-21
SLIDE 21

Use Cases

Weight Load Balancing with LVS

ipvsadm -A -t 192.168.0.40:80 -s wrr ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.10:80 -m -w 100 ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.11:80 -m -w 50

slide-22
SLIDE 22

Use Cases

Weight Load Balancing with IPT

iptables -t nat -A PREROUTING -m statistic --mode random --probability 1 \

  • d 192.168.0.40 -p tcp --dport 80 -j DNAT --to-destination 192.168.100.10:80

iptables -t nat -A PREROUTING -m statistic --mode random --probability 0.33 \

  • d 192.168.0.40 -p tcp --dport 80 -j DNAT --to-destination 192.168.100.11:80
slide-23
SLIDE 23

Use Cases

Weight Load Balancing with NFT

table ip lb { chain prerouting { type nat hook prerouting priority 0; policy accept; ip daddr 192.168.0.40 tcp dport http dnat random upto 100 map { 0-66: 192.168.100.10, 67-99: 192.168.100.11 } } }

slide-24
SLIDE 24

Use Cases

Weight Load Balancing Multiport with LVS

iptables -A PREROUTING -t mangle -d 192.168.0.40 -p tcp -m multiport \

  • -dports 80,443 -j MARK --set-mark 1

ipvsadm -A -f 1 -s wrr ipvsadm -a -f 1 -r 192.168.100.10:0 -m -w 100 ipvsadm -a -f 1 -r 192.168.100.11:0 -m -w 50

slide-25
SLIDE 25

Use Cases

Weight Load Balancing Multiport with IPT

iptables -t nat -A PREROUTING -m statistic --mode random --probability 1 \

  • d 192.168.0.40 -p tcp -m multiport --dports 80,443 -j DNAT \
  • -to-destination 192.168.100.10

iptables -t nat -A PREROUTING -m statistic --mode random --probability 0.33 \

  • d 192.168.0.40 -p tcp -m multiport --dports 80,443 -j DNAT \
  • -to-destination 192.168.100.11
slide-26
SLIDE 26

Use Cases

Weight Load Balancing Multiport with NFT

table ip lb { chain prerouting { type nat hook prerouting priority 0; policy accept; ip daddr 192.168.0.40 tcp dport { http,https } dnat random upto 100 map { 0-66: 192.168.100.10, 67-99: 192.168.100.11 } } }

slide-27
SLIDE 27

Use Cases

Weight LB IP persistence with LVS

ipvsadm -A -t 192.168.0.40:80 -s wrr -p 300 ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.10:80 -m -w 100 ipvsadm -a -t 192.168.0.40:80 -r 192.168.100.11:80 -m -w 50

slide-28
SLIDE 28

Use Cases

Weight LB IP persistence with IPT

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -m statistic --mode random --probability 1 \

  • d 192.168.0.40 -p tcp --dport 80 -j MARK --set-xmark 1

iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.33 \

  • d 192.168.0.40 -p tcp --dport 80 -j MARK --set-xmark 2

iptables -t mangle -A PREROUTING -m recent --name "mark1_list" --rcheck --seconds 120 \

  • d 192.168.0.40 -p tcp --dport 80 -j MARK --set-xmark 1

iptables -t mangle -A PREROUTING -m recent --name "mark2_list" --rcheck --seconds 120 \

  • d 192.168.0.40 -p tcp --dport 80 -j MARK --set-xmark 2

iptables -t mangle -A PREROUTING -m state --state NEW -j CONNMARK --save-mark iptables -t nat -A PREROUTING -m mark --mark 1 -j DNAT -p tcp \

  • -to-destination 192.168.100.10:80 -m recent --name "mark1_list" --set

iptables -t nat -A PREROUTING -m mark --mark 2 -j DNAT -p tcp \

  • -to-destination 192.168.100.11:80 -m recent --name "mark2_list" --set
slide-29
SLIDE 29

Use Cases

Weight LB IP persistence with NFT

table ip lb { map dnat-cache { type ipv4_addr : ipv4_addr; timeout 120s; } chain cache-done { dnat ip saddr map @dnat-cache } chain prerouting { type nat hook prerouting priority 0; policy accept; ip saddr @dnat-cache goto cache-done ip daddr 192.168.0.40 tcp dport http dnat random upto 100 map { 0-66: 192.168.100.10, 67-99: 192.168.100.11 } map dnat-cache add { ip saddr : ip daddr } } }

slide-30
SLIDE 30

Use Cases

Weighted Least Connections with NFT

BACKEND 0 BACKEND 1

prerouting nat

check_ping, check_tcp, check_http, ...

load balancer

user space kernel space

pkt

weighted nftables script

ruleset mng & health daemon

conntrack

established conns

slide-31
SLIDE 31

Use Cases

Weighted Least Response with NFT

BACKEND 0 BACKEND 1

prerouting nat

check_ping, check_tcp, check_http, ...

load balancer

user space kernel space

pkt

weighted nftables script

ruleset mng & health daemon t0 t1

slide-32
SLIDE 32

Use Cases

Weighted Least CPU Load with NFT

BACKEND 0 BACKEND 1

prerouting nat

check_ping, check_tcp, check_http, ...

load balancer

user space kernel space

pkt

weighted nftables script

ruleset mng & health daemon check_snmp(cpu)

slide-33
SLIDE 33

Work to do

slide-34
SLIDE 34

Work to do

Implement some native functions in nftables

random, nth, maps enhancements

slide-35
SLIDE 35

Work to do

Daemon nft-lbd

health checks support, dynamic weight (least connections, least response, etc.)

slide-36
SLIDE 36

Conclusions

slide-37
SLIDE 37

Conclusions

Simplify kernel infrastructure

Move complexity to User Space

slide-38
SLIDE 38

Conclusions

Consolidate kernel development

Avoid duplicated work, better maintenance, native LB support

slide-39
SLIDE 39

Conclusions

Unique API for networking handling

nftables

slide-40
SLIDE 40

Questions? Thank you! Load Balancing with nftables

Laura García (Zen Load Balancer Team) lauragl@sofintel.net