Loading... <p>一、lvs-dr类型:也称direct routing,简称为g(gatewaying);配置lvs-dr基于iptables mangle的实现方式</p> <p> 实验图:</p> <p><img src="//cto.wang/usr/uploads/2016/07/20160703160553-21.png" title="1434863660111491.png" alt="1.png" /></p> <p> 地址规划:</p> <p> VIP: 172.16.2.100</p> <p> DIP: 172.16.2.13</p> <p> RIP1:172.16.2.12</p> <p> RIP2:172.16.2.14</p> <p> 配置步骤</p> <p> (1)同步时间,以Director为时间服务器,RS以Director为时间服务器,同步时间</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# date Sun Jun 21 13:24:02 CST 2015 [root@RS1 htdocs]# date Sun Jun 21 13:24:06 CST 2015 [root@RS2 html]# date Sun Jun 21 13:24:08 CST 2015</pre> <p> (2)修改RS的内核参数,禁止响应路由器查询VIP的arp请求</p> <pre class="brush:bash;toolbar:false">[root@RS1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce [root@RS1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce [root@RS1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore [root@RS1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore</pre> <pre class="brush:bash;toolbar:false">[root@RS2 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce [root@RS2 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce [root@RS2 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore [root@RS2 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore</pre> <p> (3)修改Director的防火墙规则,开启转发功能</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# iptables -F;iptables -F -t nat [root@Director ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 [root@Director ~]# sysctl -p</pre> <p> (4)在Director、RS服务器上配置VIP地址</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ifconfig eth1:0 172.16.2.100 broadcast 172.16.2.100 netmask 255.255.255.255 [root@Director ~]# ifconfig eth1 Link encap:Ethernet HWaddr 00:0C:29:5A:4F:52 inet addr:172.16.2.13 Bcast:172.16.2.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fe5a:4f52/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:34718 errors:0 dropped:0 overruns:0 frame:0 TX packets:12253 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14209969 (13.5 MiB) TX bytes:1351338 (1.2 MiB) eth1:0 Link encap:Ethernet HWaddr 00:0C:29:5A:4F:52 inet addr:172.16.2.100 Bcast:172.16.2.100 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:80 errors:0 dropped:0 overruns:0 frame:0 TX packets:80 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:7266 (7.0 KiB) TX bytes:7266 (7.0 KiB)</pre> <pre class="brush:bash;toolbar:false">[root@RS1 ~]# ifconfig lo:0 172.16.2.100 broadcast 172.16.2.100 netmask 255.255.255.255 [root@RS1 ~]# ifconfig eth1 Link encap:Ethernet HWaddr 00:0C:29:0E:C4:33 inet addr:172.16.2.12 Bcast:172.16.2.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fe0e:c433/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:9328 errors:0 dropped:0 overruns:0 frame:0 TX packets:3795 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:8278339 (7.8 MiB) TX bytes:337391 (329.4 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:59 errors:0 dropped:0 overruns:0 frame:0 TX packets:59 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:5699 (5.5 KiB) TX bytes:5699 (5.5 KiB) lo:0 Link encap:Local Loopback inet addr:172.16.2.100 Mask:255.255.255.255 UP LOOPBACK RUNNING MTU:16436 Metric:1</pre> <pre class="brush:bash;toolbar:false">[root@RS2 ~]# ifconfig lo:0 172.16.2.100 broadcast 172.16.2.100 netmask 255.255.255.255 [root@RS2 ~]# ifconfig eth1 Link encap:Ethernet HWaddr 00:0C:29:F8:D4:92 inet addr:172.16.2.14 Bcast:172.16.2.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fef8:d492/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:161326 errors:0 dropped:0 overruns:0 frame:0 TX packets:132169 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:25610678 (24.4 MiB) TX bytes:16331857 (15.5 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:1935 errors:0 dropped:0 overruns:0 frame:0 TX packets:1935 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:197004 (192.3 KiB) TX bytes:197004 (192.3 KiB) lo:0 Link encap:Local Loopback inet addr:172.16.2.100 Mask:255.255.255.255 UP LOOPBACK RUNNING MTU:65536 Metric:1</pre> <p> (5)在Director、RS上添加去往172.16.2.100的主机路由(目的是RS构建响应报文的时候以VIP为源IP封装数据包)</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# route add -host 172.16.2.100 dev eth1:0 [root@Director ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.16.2.100 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 172.16.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 0.0.0.0 172.16.2.1 0.0.0.0 UG 0 0 0 eth1</pre> <pre class="brush:bash;toolbar:false">[root@RS1 ~]# route add -host 172.16.2.100 dev lo:0 [root@RS1 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.16.2.100 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.16.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 0.0.0.0 172.16.2.1 0.0.0.0 UG 0 0 0 eth1</pre> <pre class="brush:bash;toolbar:false">[root@RS2 ~]# route add -host 172.16.2.100 dev lo:0 [root@RS2 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.16.2.100 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.16.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 0.0.0.0 172.16.2.1 0.0.0.0 UG 0 0 0 eth1</pre> <p> (6)在Director上利用iptables将http流量打标记</p> <pre class="brush:bash;toolbar:false">root@Director ~]# iptables -t mangle -A PREROUTING -d 172.16.2.100 -p tcp --dport 80 -j MARK --set-mark 6 [root@Director ~]# iptables -L -n -t mangle Chain PREROUTING (policy ACCEPT) target prot opt source destination MARK tcp -- 0.0.0.0/0 172.16.2.100 tcp dpt:80 MARK set 0x6</pre> <p> (7)在Director上创建基于防火墙标记的集群</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ipvsadm -A -f 6 -s rr</pre> <p> (8)在Director上创建的iptables防护墙标记集群添加RS</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ipvsadm -a -f 6 -r 172.16.2.12 -g -w 1 [root@Director ~]# ipvsadm -a -f 6 -r 172.16.2.14 -g -w 1 [root@Director ~]# ipvsadm -L -n IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn FWM 6 rr -> 172.16.2.12:0 Route 1 0 0 -> 172.16.2.14:0 Route 1 0 0</pre> <p> (9)打开浏览器,输入地址:http://172.16.2.100,刷新页面查看变化; </p> <p> <img src="//cto.wang/usr/uploads/2016/07/20160703160553-66.png" title="1434869580115968.png" alt="7.png" /> <img src="//cto.wang/usr/uploads/2016/07/20160703160553-41.png" title="1434869572913801.png" alt="6.png" /></p> <p></p> <p></p> <p>二、lvs的持久连接:</p> <p> 1)lvs的持久连接目的:</p> <p> 无论使用何种调度方法,持久连接都能保证在指定的时间段内,将来自同一个IP的请求始终定向至同一个RS</p> <p> </p> <p> 2)lvs的持久连接类型:</p> <p> PCC: 每客户端持久连接</p> <p> 在持久连接时长内,来自同一个的CIP对VIP的请求,无论请求什么服务,都统统转发至第一次挑选出的RS;定义TCP或UDP集群服务时,其端口为0;</p> <p> PPC: 每端口持久连接</p> <p> 单端口持久调度;分属于不同的端口,不会跨端口调度</p> <p> PFM: 每FWM持久连接</p> <p> 单FWM调度;分属于不同的FWM,不会跨FWM调度</p> <p></p> <p> 3)实现方法:只有在创建服务集群时添加-p选项,其他过程都与lvs-dr一样,没有变化</p> <p> PCC实现方法:</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ipvsadm -A -t 172.16.2.100 -s rr -p 300 \\添加会话保持时间为300s,单位是秒</pre> <p> PPC实现方法:</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ipvsadm -A -t 172.16.2.100:80 -s rr -p 300</pre> <p> PFM实现方法:</p> <pre class="brush:bash;toolbar:false">[root@Director ~]# ipvsadm -A -f 6 -s rr -p 300</pre> <p></p> 最后修改:2021 年 12 月 10 日 10 : 53 AM © 允许规范转载 赞赏 如果觉得我的文章对你有用,请随意赞赏 赞赏作者 支付宝微信