~LVS的nat模式+ipvsadm命令的使用+lvs的dr模式实现+lvs火墙标记

lvs简介

LVS:Linux Virtual Server，负载调度器，内核集成，章文嵩，阿里的四层SLB(Server LoadBalance)是基于LVS+keepalived实现

lvs集群的类型

lvs-nat：修改请求报文的目标IP,多目标IP的DNAT

lvs-dr：操纵封装新的MAC地址 lvs-tun：在原请求IP报文之外新加一个IP首部

lvs-fullnat：修改请求报文的源和目标IP

一、lvs的nat模式

lvs是nat模式

[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth1.connection 
[connection]
id=eth1
type=ethernet
interface-name=eth1
 
[ipv4]
address1=192.168.0.100/24
method=manual

克隆两个名为webserver1和webserver2，且为仅主机模式

webserver1

[root@webserver1 ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=192.168.0.10/24,192.168.0.100
method=manual

webserver2

[root@webserver2 ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=192.168.0.20/24,192.168.0.100
method=manual

网关设不设不影响实验

搭建nat模式

别忘了下载web服务

在webserver里配置

echo webserver1-192.168.0.10 > /var/www/html/index.html       
 
echo webserver1-192.168.0.20 > /var/www/html/index.html

再下载ipvsadm

ipvsadm命令核心功能: 集群服务管理:增、删、改集群服务的RS管理:增、删、改查看

接着配置规则

ipvsadm -A -t 172.25.254.100:80 -s rr
ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.10 -m
ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.20 -m
ipvsadm -Ln
watch -n 1 ipvsadm -Ln --rate

测试结果

二、 ipvsadm命令的使用

命令参数

管理集群服务
ipvsadm -A|E -t（tcp）|u（udp）|f（防护墙标签） \
service-address(集群地址) \
[-s scheduler(调度算法)] \
[-p [timeout]] \
[-M netmask] \
[--pepersistence_engine] \
[-b sched-flags]
ipvsadm -D -t|u|f service-address 删除
ipvsadm --C 清空
ipvsadm --R 重载
ipvsadm -S [-n] 保存
管理集群中的real server
ipvsadm -a|e -t|u|f service-address -r server-address [-g | -i| -m](工作模式) [-w 
weight](权重)
ipvsadm -d -t|u|f service-address -r server-address 删除RS
ipvsadm -L|l [options] 查看rs
ipvsadm -Z [-t|u|f service-address] 清楚计数器

三、lvs的dr模式实现

DR：Direct Routing，直接路由，LVS默认模式,应用最广泛,通过为请求报文重新封装一个MAC首部进行转发，源MAC是DIP所在的接口的MAC，目标MAC是某挑选出的RS的RIP所在接口的MAC地址；源 IP/PORT，以及目标IP/PORT均保持不变

lvs主机

[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=192.168.0.50/24,192.168.0.100
method=manual

webserver1

[root@server1 ~]# cat /etc/NetworkManager/system-connections/eth0.connection
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=192.168.0.10/24,192.168.0.100
method=manual

webserver2

[root@server2 ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=192.168.0.20/24,192.168.0.100
method=manual

路由器主机（router）

[root@router ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=172.25.254.100/24,172.25.254.2
dns=114.114.114.114;
method=manual

[root@router ~]# cat /etc/NetworkManager/system-connections/eth1.connection 
[connection]
id=eth1
type=ethernet
interface-name=eth1
 
[ipv4]
address1=192.168.0.100/24
method=manual

客户端nat模式（client）

[root@client ~]# cat /etc/NetworkManager/system-connections/eth0.connection 
[connection]
id=eth0
type=ethernet
interface-name=eth0
 
[ipv4]
address1=172.25.254.200/24,172.25.254.100
method=manual

之后打开内核路由功能

rs主机中vip不对外响应

在lvs中配置策略

echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore 
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce 
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce 
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore

lvs设定：

ipvsadm -A -t 192.168.0.200:80 -s wrr
ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g -w 1
ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g -w 2

别忘了启用IP转发

vim /etc/sysctl.conf           
net.ipv4.ip_forward = 1     
 
ipvsadm -p

在lvs主机和rs主机添加vip

测试效果

[root@client ~]# for N in {1..10};
do 
curl 192.168.0.200;
done
RS2 server - 192.168.0.20
RS1 server - 192.168.0.10
RS2 server - 192.168.0.20
RS2 server - 192.168.0.20
RS1 server - 192.168.0.10
RS2 server - 192.168.0.20
RS2 server - 192.168.0.20
RS1 server - 192.168.0.10
RS2 server - 192.168.0.20
RS2 server - 192.168.0.20

四、lvs火墙标记

]# yum install mod_ssl -y
]# systemctl restart httpd

[root@lvs ~]# ipvsadm -A -t 192.168.0.100:80 -s rr
[root@lvs ~]# ipvsadm -A -t 192.168.0.100:443 -s rr
[root@lvs ~]# ipvsadm -a -t 192.168.0.100:80 -r 192.168.0.101:80 -g
[root@lvs ~]# ipvsadm -a -t 192.168.0.100:80 -r 192.168.0.102:80 -g
[root@lvs ~]# ipvsadm -a -t 192.168.0.100:443 -r 192.168.0.102:80 -g
[root@lvs ~]# ipvsadm -a -t 192.168.0.100:443 -r 192.168.0.101:80 -g

测试

[root@node10 ~]# curl http://192.168.0.100;curl -k https://192.168.0.100
RS1 server - 192.168.0.101
RS1 server - 192.168.0.101