<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.18.3">
</HEAD>
<BODY>
Hi list,<BR>
<BR>
I' am creating a HA iptables firewall using conntrack-tools, keepalived and drbd.<BR>
<BR>
It seems to be working nice but when i make a stress test (reboot de primary node so the secondary should became primary and when the other node starts up change again to secondary) sometimes 15% to 20% the drbd device does not change its state. The error that appears in the logs is: State change failed: Device is held open by someone.<BR>
<BR>
I cant understand that because the script that is in use is the following:<BR>
<BR>
case "$1" in<BR>
primary)<BR>
/usr/local/sbin/conntrackd -c<BR>
/usr/local/sbin/conntrackd -R<BR>
/etc/fwbuilder/firewall_script.sh<BR>
iptables -I FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT<BR>
iptables -I FORWARD -i eth1 -p tcp --syn -m state --state NEW -j ACCEPT<BR>
iptables -I FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT<BR>
iptables -I INPUT -d 225.0.0.50 -j ACCEPT<BR>
iptables -I INPUT -d 224.0.0.18 -j ACCEPT<BR>
iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT<BR>
iptables -I OUTPUT -d 224.0.0.18 -j ACCEPT<BR>
iptables -I INPUT -p tcp -m tcp --dport 7788 -j ACCEPT<BR>
iptables -I OUTPUT -p tcp -m tcp --dport 7788 -j ACCEPT<BR>
drbdadm primary r0<BR>
mount /dev/drbd0 /etc/fwbuilder<BR>
;;<BR>
fault)<BR>
for a in $(ip a l eth1 | grep inet | grep secondary | awk '{print $2}'); do ip addr del $a dev eth1; done<BR>
umount /etc/fwbuilder<BR>
drbdadm secondary r0<BR>
;;<BR>
backup)<BR>
for a in $(ip a l eth1 | grep inet | grep secondary | awk '{print $2}'); do ip addr del $a dev eth1; done<BR>
/usr/local/sbin/conntrackd -B<BR>
umount /etc/fwbuilder<BR>
drbdadm secondary r0<BR>
;;<BR>
esac<BR>
<BR>
exit 0 <BR>
<BR>
<BR>
As you can see the script ensures that when a node becomes secondary it umount the disk and converts de drbd device in secondary so the other node can become primary and mount the device.<BR>
<BR>
I've tried it with the drbd device in reiserfs, ext3 and ext2 with the same problem. <BR>
<BR>
Does any of you know what should happen?. Any way to solve it? any ideas.<BR>
<BR>
Thanks for your help.<BR>
<BR>
Aiko
</BODY>
</HTML>