目录
NAT
LVS
LVS集群的类型:
LVS-NAT模式实验
环境准备:
实验步骤:
LVS-DR模式实验
题目:
环境准备:
实验步骤:
LVS-防火墙标签解决轮询调度问题
环境准备:
实验步骤:
NAT
NAT:网络地址转换。是将IP数据包头中的IP地址转换为另一个IP地址的过程。在实际的应用中,NAT主要用于实现私有网络访问公共网络的功能。NAT可分为SNAT和DNAT:
SNAT:源网络地址转换。内部地址要访问公网上的服务时,内部地址会主动发起连接,将内部地址转换为公网IP。
DNAT:目标网络地址转换。内部需要对外提供服务时,外部主动发起连接,路由器或者防火墙的网络接收到这个连接,然后将连接转换到内部,此过程是由带公网ip的网关代替内部服务来接收外部的连接,然后在内部做地址转换。作为单点的网络地址转换,只能指向一台主机服务器。
DNAT不能实现同时指向两台主机服务器,所以有了调度器。
LVS
LVS(Linux Virtual Server):负载调度器,是内核集成的。四层负载(可改变MAC地址、ip、端口)
负载均衡:四层(物理层、数据链路层(MAC)、网络层(ip)、传输层)和七层。
VS:调度器,负责调度
RS:负责真实处理业务的主机,负责真正提供服务
CIP:客户IP
VIP:客户访问LVS的IP,对客户开放的
DIP:LVS访问内部主机的IP
RIP:RS真实主机上的IP
流程:CIP <---> (VIP === DIP) <---> RIP
LVS集群的类型:
lvs-nat:修改请求报文的目标IP,多目标IP的DNAT(即将原本请求到VIP,在LVS内部做转换,将其指向SIP;客户主机IP不变,变客户要到达的目的地)
lvs-dr:操纵封装新的MAC地址
lvs-tun:在原请求IP报文之外新加一个IP首部(即请求发送到LVS时,加一段报文,当请求返回时删掉加的报文)
lvs-fullnat:修改请求报文的源和目标IP(即客户主机IP变为DIP,客户要到达的目的地变为RIP)
LVS-NAT模式实验
环境准备:
1. rhel9克隆,LVS 添加网络适配器(仅主机模式)
2. rhel9克隆,webserver1(网络适配器:仅主机)
3. rhel9克隆,webserver2(网络适配器:仅主机)
实验步骤:
以下的vmset.sh为设置IP及解析
[root@haproxy ~]# cat /bin/vmset.sh
#!/bin/bash
rm -fr /etc/NetworkManager/system-connections/$1.nmconnection
cat > /etc/NetworkManager/system-connections/$1.nmconnection <<EOF
[connection]
id=$1
type=ethernet
interface-name=$1[ipv4]
address1=$2/24,172.25.254.2
method=manual
dns=114.114.114.114;
EOFchmod 600 /etc/NetworkManager/system-connections/$1.nmconnection
nmcli connection reload
nmcli connection up $1hostnamectl hostname $3cat > /etc/hosts <<EOF
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
$2 $3
EOF
LVS部分
# LVS部分#设置网卡IP信息
[root@lvs ~]# vmset.sh eth0 172.25.254.100 lvs.company.org
[root@lvs ~]# vmset.sh eth1 192.168.0.100 lvs.company.org
[root@lvs ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 172.25.254.100 netmask 255.255.255.0 broadcast 172.25.254.255inet6 fe80::e9d9:e029:7f5a:84bf prefixlen 64 scopeid 0x20<link>ether 00:0c:29:a6:46:7f txqueuelen 1000 (Ethernet)RX packets 131 bytes 15879 (15.5 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 159 bytes 17606 (17.1 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.0.100 netmask 255.255.255.0 broadcast 192.168.0.255inet6 fe80::6ac0:a367:3ffc:d505 prefixlen 64 scopeid 0x20<link>ether 00:0c:29:a6:46:89 txqueuelen 1000 (Ethernet)RX packets 206 bytes 13419 (13.1 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 83 bytes 11170 (10.9 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 0 bytes 0 (0.0 B)RX errors 0 dropped 0 overruns 0 frame 0TX packets 0 bytes 0 (0.0 B)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@lvs ~]# vim /etc/NetworkManager/system-connections/eth1.nmconnection
[root@lvs ~]# vim /etc/NetworkManager/system-connections/eth0.nmconnection
[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.100/24,172.25.254.2
method=manual
dns=114.114.114.114;
[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth1.nmconnection
[connection]
id=eth1
type=ethernet
interface-name=eth1[ipv4]
address1=192.168.0.100/24
method=manual[root@lvs ~]# nmcli connection reload
[root@lvs ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/12)
[root@lvs ~]# nmcli connection up eth1
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/13)# net.ipv4.ip_forward = 1 使其作为路由器
# LVS中打开内核路由功能
[root@lvs ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
[root@lvs ~]# vim /etc/sysctl.conf #在文件最后编写:net.ipv4.ip_forward = 1
[root@lvs ~]# sysctl -p
net.ipv4.ip_forward = 1
webserver1部分
# webserver1部分
[root@webserver1 ~]# vmset.sh eth0 192.168.0.10 webserver1.company.org
[root@webserver1 ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.0.10 netmask 255.255.255.0 broadcast 192.168.0.255inet6 fe80::e9d9:e029:7f5a:84bf prefixlen 64 scopeid 0x20<link>ether 00:0c:29:03:5f:47 txqueuelen 1000 (Ethernet)RX packets 162 bytes 17779 (17.3 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 153 bytes 11247 (10.9 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 72 bytes 6984 (6.8 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 72 bytes 6984 (6.8 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@webserver1 ~]# vim /etc/NetworkManager/system-connections/eth0.nmconnection
[root@webserver1 ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=192.168.0.10/24,192.168.0.100
method=manual[root@webserver1 ~]# nmcli connection reload
[root@webserver1 ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@webserver1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver1 ~]#
[root@webserver1 ~]# dnf install httpd -y
[root@webserver1 ~]# echo webserver1 - 192.168.0.10 > /var/www/html/index.html
[root@webserver1 ~]# systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
webserver2部分
# webserver2部分
[root@webserver1 ~]# vmset.sh eth0 192.168.0.20 webserver2.company.org
[root@webserver2 ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.0.20 netmask 255.255.255.0 broadcast 192.168.0.255inet6 fe80::b947:4cf:357d:b67e prefixlen 64 scopeid 0x20<link>ether 00:0c:29:f6:d1:9e txqueuelen 1000 (Ethernet)RX packets 148 bytes 16617 (16.2 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 155 bytes 11559 (11.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 72 bytes 6984 (6.8 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 72 bytes 6984 (6.8 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@webserver2 ~]# vim /etc/NetworkManager/system-connections/eth0.nmconnection
[root@webserver2 ~]# nmcli connection reload
[root@webserver2 ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@webserver2 ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=192.168.0.20/24,192.168.0.100
method=manual
dns=114.114.114.114;
[root@webserver2 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver2 ~]#
[root@webserver2 ~]# dnf install httpd -y
[root@webserver2 ~]# echo webserver2 - 192.168.0.20 > /var/www/html/index.html
[root@webserver2 ~]# systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
LVS策略部分
-A:增加虚拟server
-t:增加的调度协议(TCP/UDP)
-s:指定调度算法(rr:轮询,静态算法)
-r:real server
-m:LVS模式
-g:直连路由
-i:隧道
-w:指定权重
# 再次LVS部分中操作
[root@lvs ~]# curl 192.168.0.10
webserver1 - 192.168.0.10
[root@lvs ~]# curl 192.168.0.20
webserver2 - 192.168.0.20#安装负载均衡工具:ipvsadm是管理IP虚拟服务器(IPVS)功能不可或缺的工具。IPVS是内核级负载均衡技术,支持多种负载均衡算法
[root@lvs ~]# dnf install ipvsadm -y
#查看策略
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
[root@lvs ~]# ipvsadm -A -t 172.25.254.100:80 -s rr
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.254.100:80 rr
[root@lvs ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.10:80 -m
[root@lvs ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.20:80 -m
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.254.100:80 rr-> 192.168.0.10:80 Masq 1 0 0 -> 192.168.0.20:80 Masq 1 0 0
测试
# 测试部分:
[root@lvs ~]# for i in {1..10}
> do
> curl 172.25.254.100
> done
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
LVS-DR模式实验
题目:
环境准备:
需要准备 5 台虚拟机,皆使用 rhel9 的备份
从左往右,第一个为client,第二个作为路由,第三个作为lvs,第四个为webserver1(rs1),第五个为webserver2(rs2)
注意:该实验紧接着上个实验操作。
实验步骤:
lvs部分
#lvs部分:
[root@lvs ~]# nmcli connection delete eth0
[root@lvs ~]# vmset.sh eth1 192.168.0.50 lvs.company.org
[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth1.nmconnection
[connection]
id=eth1
type=ethernet
interface-name=eth1[ipv4]
address1=192.168.0.50/24,192.168.0.100
method=manual
[root@lvs ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth1
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth1
[root@lvs ~]#
[root@lvs ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500ether 00:0c:29:a6:46:7f txqueuelen 1000 (Ethernet)RX packets 7939 bytes 589584 (575.7 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 8168 bytes 798939 (780.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.0.50 netmask 255.255.255.0 broadcast 192.168.0.255inet6 fe80::6ac0:a367:3ffc:d505 prefixlen 64 scopeid 0x20<link>ether 00:0c:29:a6:46:89 txqueuelen 1000 (Ethernet)RX packets 924 bytes 105858 (103.3 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 805 bytes 68911 (67.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 72 bytes 7464 (7.2 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 72 bytes 7464 (7.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@lvs ~]#
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:7f brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:89 brd ff:ff:ff:ff:ff:ffaltname enp19s0altname ens224inet 192.168.0.50/24 brd 192.168.0.255 scope global noprefixroute eth1valid_lft forever preferred_lft foreverinet6 fe80::6ac0:a367:3ffc:d505/64 scope link noprefixroute valid_lft forever preferred_lft forever#添加环回
[root@lvs ~]# ip a a 192.168.0.200/32 dev lo
[root@lvs ~]# nmcli connection reload
[root@lvs ~]# nmcli connection up lo
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/16)
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:7f brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:89 brd ff:ff:ff:ff:ff:ffaltname enp19s0altname ens224inet 192.168.0.50/24 brd 192.168.0.255 scope global noprefixroute eth1valid_lft forever preferred_lft foreverinet6 fe80::6ac0:a367:3ffc:d505/64 scope link noprefixroute valid_lft forever preferred_lft forever#配置策略
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.254.100:80 wrr-> 192.168.0.10:80 Masq 2 0 0 -> 192.168.0.20:80 Masq 1 0 0
[root@lvs ~]# ipvsadm -C
[root@lvs ~]# ipvsadm -A -t 192.168.0.200:80 -s wrr
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g -w 1
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g -w 2
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.0.200:80 wrr-> 192.168.0.10:80 Route 1 0 0 -> 192.168.0.20:80 Route 2 0 0
webserver1部分
#webserver1部分:
[root@webserver1 ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 192.168.0.10 netmask 255.255.255.0 broadcast 192.168.0.255inet6 fe80::e9d9:e029:7f5a:84bf prefixlen 64 scopeid 0x20<link>ether 00:0c:29:03:5f:47 txqueuelen 1000 (Ethernet)RX packets 2089 bytes 181324 (177.0 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 1766 bytes 157952 (154.2 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 248 bytes 22424 (21.8 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 248 bytes 22424 (21.8 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0#rs主机中使vip不对外相应
# arp_ignore 1:仅在请求的目标IP配置在本地主机的接收到请求报文的接口上时,才给予响应
# arp_announce 2:必须避免将接口信息向非本网络进行通告
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[root@webserver1 ~]#
[root@webserver1 ~]# vim /etc/NetworkManager/system-connections/eth0.nmconnection
[root@webserver1 ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=192.168.0.10/24,192.168.0.100
method=manual
[root@webserver1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver1 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 1
[root@webserver1 ~]#
#添加环回ip
[root@webserver1 ~]# ip a a 192.168.0.200/32 dev lo
webserver2部分
#webserver2部分:
#rs主机中使vip不对外相应
# arp_ignore 1:仅在请求的目标IP配置在本地主机的接收到请求报文的接口上时,才给予响应
# arp_announce 2:必须避免将接口信息向非本网络进行通告
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[root@webserver2 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver2 ~]#
#添加环回ip
[root@webserver2 ~]# ip a a 192.168.0.200/32 dev lo
router部分
#router部分:
[root@router ~]# vim /etc/NetworkManager/system-connections/eth1.nmconnection
[root@router ~]# nmcli connection reload
[root@router ~]# nmcli connection up eth1
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/8)
[root@router ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.100/24,172.25.254.2
method=manual
dns=114.114.114.114;
[root@router ~]# cat /etc/NetworkManager/system-connections/eth1.nmconnection
[connection]
id=eth1
type=ethernet
interface-name=eth1[ipv4]
address1=192.168.0.100/24
method=manual
[root@router ~]#
[root@router ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0#编辑配置文件,使其主机作为路由器使用(net.ipv4.ip_forward = 1)
[root@router ~]# vim /etc/sysctl.conf
[root@router ~]# sysctl -p
net.ipv4.ip_forward = 1
[root@router ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
client部分
#client部分:
[root@client ~]# vim /etc/NetworkManager/system-connections/eth0.nmconnection
[root@client ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.200/24,172.25.254.100
method=manual[root@client ~]# nmcli connection reload
[root@client ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@client ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.25.254.100 0.0.0.0 UG 100 0 0 eth0
172.25.254.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@client ~]#
[root@client ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500inet 172.25.254.200 netmask 255.255.255.0 broadcast 172.25.254.255inet6 fe80::b947:4cf:357d:b67e prefixlen 64 scopeid 0x20<link>ether 00:0c:29:9a:63:75 txqueuelen 1000 (Ethernet)RX packets 390 bytes 34551 (33.7 KiB)RX errors 0 dropped 0 overruns 0 frame 0TX packets 400 bytes 41933 (40.9 KiB)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536inet 127.0.0.1 netmask 255.0.0.0inet6 ::1 prefixlen 128 scopeid 0x10<host>loop txqueuelen 1000 (Local Loopback)RX packets 0 bytes 0 (0.0 B)RX errors 0 dropped 0 overruns 0 frame 0TX packets 0 bytes 0 (0.0 B)TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[root@client ~]#
[root@client ~]# for i in {1..10}
> do
> curl 192.168.0.200
> done
^C #之所以不成功,是因为webserver1和webserver2没有添加环回IP#添加环回后再次测试
[root@client ~]# for i in {1..10}
> do
> curl 192.168.0.200
> done
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
webserver2 - 192.168.0.20
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
[root@client ~]#
LVS-防火墙标签解决轮询调度问题
环境准备:
在 LVS-DR 模式的实验基础上完成此次实验操作
注意检查环回IP,sysctl -a | grep arp_ignore
实验步骤:
LVS部分
#LVS部分
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
[root@lvs ~]# cat /etc/sysconfig/ipvsadm
-A -t 172.25.254.100:80 -s rr
-a -t 172.25.254.100:80 -r 192.168.0.10:80 -m -w 1
-a -t 172.25.254.100:80 -r 192.168.0.20:80 -m -w 2
[root@lvs ~]# systemctl stop ipvsadm
[root@lvs ~]# systemctl restart ipvsadm
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.254.100:80 rr-> 192.168.0.10:80 Masq 1 0 0 -> 192.168.0.20:80 Masq 2 0 0 #或者
#[root@lvs ~]# ipvsadm -A -t 192.168.0.200:80 -s rr
#[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g -w 1
#[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g -w 2#防火墙标签解决轮询调度(错误)问题
[root@lvs ~]# ipvsadm -A -t 192.168.0.200:443 -s rr
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.10:443 -g
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.20:443 -g
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.0.200:80 rr-> 192.168.0.10:80 Route 1 0 0 -> 192.168.0.20:80 Route 2 0 0
TCP 192.168.0.200:443 rr-> 192.168.0.10:443 Route 1 0 0 -> 192.168.0.20:443 Route 1 0 0
[root@lvs ~]#
[root@lvs ~]#
[root@lvs ~]#
[root@lvs ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 101 0 0 eth1
192.168.0.0 0.0.0.0 255.255.255.0 U 101 0 0 eth1
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:7f brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet6 fe80::1f9:ac64:1bc5:7e43/64 scope link noprefixroute valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:89 brd ff:ff:ff:ff:ff:ffaltname enp19s0altname ens224inet 192.168.0.50/24 brd 192.168.0.255 scope global noprefixroute eth1valid_lft forever preferred_lft foreverinet6 fe80::6ac0:a367:3ffc:d505/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@lvs ~]# ip a a 192.168.0.200/32 dev lo
[root@lvs ~]# nmcli connection reload
[root@lvs ~]# nmcli connection up lo
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/14)
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:7f brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet6 fe80::1f9:ac64:1bc5:7e43/64 scope link noprefixroute valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:a6:46:89 brd ff:ff:ff:ff:ff:ffaltname enp19s0altname ens224inet 192.168.0.50/24 brd 192.168.0.255 scope global noprefixroute eth1valid_lft forever preferred_lft foreverinet6 fe80::6ac0:a367:3ffc:d505/64 scope link noprefixroute valid_lft forever preferred_lft forever[root@lvs ~]# iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination Chain INPUT (policy ACCEPT)
target prot opt source destination Chain FORWARD (policy ACCEPT)
target prot opt source destination Chain OUTPUT (policy ACCEPT)
target prot opt source destination Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
[root@lvs ~]# iptables -t mangle -A PREROUTING -d 192.168.0.200 -p tcp -m multiport --dports 80,443 -j MARK --set-mark 66
[root@lvs ~]# iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
MARK tcp -- 0.0.0.0/0 192.168.0.200 multiport dports 80,443 MARK set 0x42Chain INPUT (policy ACCEPT)
target prot opt source destination Chain FORWARD (policy ACCEPT)
target prot opt source destination Chain OUTPUT (policy ACCEPT)
target prot opt source destination Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
[root@lvs ~]#
[root@lvs ~]# ipvsadm -C
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
[root@lvs ~]# ipvsadm -A -f 66 -s rr
[root@lvs ~]# ipvsadm -a -f 66 -r 192.168.0.10 -g
[root@lvs ~]# ipvsadm -a -f 66 -r 192.168.0.20 -g[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port Forward Weight ActiveConn InActConn
FWM 66 rr-> 192.168.0.10:0 Route 1 0 0 -> 192.168.0.20:0 Route 1 0 0
webserver1部分
#webserver1部分
[root@webserver1 ~]# yum install mod_ssl -y
Complete!
[root@webserver1 ~]#
[root@webserver1 ~]# systemctl restart httpd#以下是解决: [root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
# curl: (7) Failed to connect to 192.168.0.200 port 80: No route to host
# curl: (7) Failed to connect to 192.168.0.200 port 443: No route to host
[root@webserver1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver1 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 0
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[root@webserver1 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 1
[root@webserver1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:03:5f:47 brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.10/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::e9d9:e029:7f5a:84bf/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@webserver1 ~]# ip a a 192.168.0.200/32 dev lo
[root@webserver1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:03:5f:47 brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.10/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::e9d9:e029:7f5a:84bf/64 scope link noprefixroute valid_lft forever preferred_lft forever
webserver2部分
#webserver2部分
[root@webserver2 ~]# yum install mod_ssl -y
Complete!
[root@webserver2 ~]#
[root@webserver2 ~]# systemctl restart httpd
[root@webserver2 ~]#
[root@webserver2 ~]#
[root@webserver2 ~]# 以下是解决 ‘No route to host’ 问题。因为没有环回地址,使其client不能访问
[root@webserver2 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
[root@webserver2 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 0
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[root@webserver2 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 1
[root@webserver2 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:f6:d1:9e brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.20/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::b947:4cf:357d:b67e/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@webserver2 ~]# ip a a 192.168.0.200/32 dev lo
[root@webserver2 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:f6:d1:9e brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.20/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::b947:4cf:357d:b67e/64 scope link noprefixroute valid_lft forever preferred_lft forever
client部分
#client部分
#这是因为,在上一次实验中,虚拟机关机后,之前设置的 '环回IP' 以及 'rs主机中使vip不对外相应'
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
curl: (7) Failed to connect to 192.168.0.200 port 80: No route to host
curl: (7) Failed to connect to 192.168.0.200 port 443: No route to host#这是因为防火墙标签解决轮询调度(错误)问题
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2 - 192.168.0.20
webserver2 - 192.168.0.20
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver1 - 192.168.0.10
webserver1 - 192.168.0.10
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2 - 192.168.0.20
webserver2 - 192.168.0.20
[root@client ~]# #LVS解决后,成功实现
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2 - 192.168.0.20
webserver1 - 192.168.0.10