LVS知识点整理及实践

LVS

lvs集群概念

LVS(Linux Virtual Server):负责调度器,内核集成的虚拟服务器,主要用于多服务器的负载均衡,工作于网络层,可以实现高性能,高可用的服务集群技术,可以把许多服务器结合在一起形成一个更高性能的服务器

lvs概念

VS	Virtual Server
RS	Real Server
CIP	Client IP
VIP	Virtual server IP
DIP	Directory IP
RIP	Real server IP

访问流程: CIP<---->VIP==DIP<---->RIP

lvs集群类型

集群类型	说明
lvs-nat	修改请求报文的目标ip,多目标IP的DANT
lvs-dr	操作封装新的MAC地址
lvs-tun	在原请求IP报文之外新加一个IP首部
lvs-fullmat	修改请求报文的源和目标ip

lvs-nat模型

• 本质是多目标IP的DNAT.通过将请求报文中的目标地址和目标端口修改为某挑出的RS和RIP和POST实现转发
• RIP和DIP应在同意个ip网络,且应使用私网地址,RS的网关要指向DIP
• 请求报文和相应报文都必须经由Director转发,Director易于成为系统瓶颈
• 支持端口映射,可修改请求报文的目标PORT
• VS必须是linux系统,RS可以是任意OS系统

数据逻辑:

1. 客户端发送访问请求,请求数据包中含有请求来源(CIP),访问目标地址(VIP)访问目标端口(9000port)
2. VS服务器接收到访问请求做DNAT把请求数据包中的目的地由VIP换成RS的RIP和相应端口
3. RS1相应请求,发送相应数据包.包中的相应包为数据来源(RIP1)相应目标(CIP)相应端口(9000port)
4. VS服务器接收到相应数据包,改变包中的数据来源(RIP1–>VIP),相应目标端口(9000->80)
5. VS服务器把修改过报文的相应数据包回传给客户端
6. lvs的NAT模式接收和返回客户端数据包时都要经过lvs的调度机,所以lvs的调度机容易阻塞

lvs-DR模式

数据传输和过程:

1. 客户端发送数据帧给vs调度主机帧中内容为客户端IP+客户端的MAC+VIP+VIP的MAC
2. VS调度主机接受到数据帧后把帧中的VIP的MAC改为了RS1中的MAC,此时帧中的数据为客户端IP+客户端的MAC+VIP+RS1的MAC
3. RS1得到2中的数据包做出响应回传数据包,数据包中的内容为VIP+RS1的MAC+客户端IP+客户端IP的MAC

特点:

1. Directory和各RS都配置有VIP

2. 确保前端路由器将目标IP为VIP的请求报文发往Director

3. 在全段网关做静态帮定VIP和Directory的MAC地址

   • 在RS上使用arptables工具

     arptables -A IN -d $VIP -j DROP
     arptables -A OUT -s $VIP -j mangle --mangle-ip-s $RIP
     

   • 在RS上修改内核参数以限制arp通告及应答级别

     /proc/sys/net/ipv4/conf/all/arp_ignore
     /proc/sys/net/ipv4/conf/all/arp_announce
     

4. RS的RIP可以使用私网地址,也可以是公网地址,RIP与DIP在同一IP网络

5. RIP的网关不能指向DIP,以确保响应报文不会经由Director

6. RS的Director要在同一网络

7. 请求报文要经由Director,但响应报文不经由Director,而由RS直接发往Client

8. 不支持端口映射(端口不能修改)

9. RS可适用大多数OS系统

lvs-tun模式

转发方式：不修改请求报文的IP首部（源IP为CIP，目标IP为VIP），而在原IP报文之外再封装一个IP首部 （源IP是DIP，目标IP是RIP），将报文发往挑选出的目标RS；RS直接响应给客户端（源IP是VIP，目标IP 是CIP）

数据传输过程:

1. 客户端发送请求数据包，包内有源IP+vip+dport
2. 到达vs调度器后对客户端发送过来的数据包重新封装添加IP报文头，新添加的IP报文头中包含 TUNSRCIP(DIP)+TUNDESTIP(RSIP1)并发送到RS1
3. RS收到VS调度器发送过来的数据包做出响应，生成的响应报文中包含SRCIP(VIP)+DSTIP（CIP） +port，响应数据包通过网络直接回传给client

特点:

1. DIP, VIP, RIP都应该是公网地址
2. RS的网关一般不能指向DIP
3. 请求报文要经由Director，但响应不能经由Director
4. 不支持端口映射
5. RS的OS须支持隧道功能

lvs-fullnet模式

数据传输过程

fullnat：通过同时修改请求报文的源IP地址和目标IP地址进行转发

CIP --> DIP

VIP --> RIP

1. VIP是公网地址，RIP和DIP是私网地址，且通常不在同一IP网络；因此，RIP的网关一般不会指向DIP
2. RS收到的请求报文源地址是DIP，因此，只需响应给DIP；但Director还要将其发往Client
3. 请求和响应报文都经由Director
4. 支持端口映射

注意: 此类型kernel默认不支持

lvs调度算法

lvs调度算法类型

ipvs scheduler:根据其调度时是否考虑各RS当前的负载均衡状态被分为两种:静态方法和动态方法

静态方法:仅根据算法本身进行调度,不考虑RS的负载情况

动态方法:主要根据每RS当前的负载状态及调度算法进行调度Overhead=value较小的RS将被调度

lvs静态调度算法

1. RR:roundrobin轮询,RS分别被调用,当RS配置有差别时不推荐
2. WRR:Weighted RR,加权轮询根据RS的配置进行加权调度,性能差的RS被调度的次数少
3. SH:Source Hashing,实现session sticky,源地址hash;将来自于同一个IP地址的请求始终发往第一次挑中的RS,从而实现会话绑定
4. DH:Destination Hashing,目标地址hash,第一次轮询调整度至RS,后续将发往同一个目标地址的请求始终发至第一次挑中的RS,典型使用场景是正向代理缓存场景中的负载均衡,如:宽带运营商

lvs动态调度算法

主要是根据当前的负载状态及调度算法进行调度Overhead=value较小的RS会被调度

1. LC:最少连接(least connection)
   • 适用于长连接应用:负载值(Overhead)=活动链接数(activeconns)x256+非活动链接数(inactiveconns)
2. WLC:权重最少连接(Weighted LC)
   • 初始链接高权重优先Overhead=(activeconns+1+inactiveconns)x256/weight
   • 但是,当node1的权重为1,node2的权重为10,经过运算前几次调度都会被node2承接
3. SED:最短期望延迟(Shortest Expection Delay)
4. NQ:第一轮询均匀分配,后续SED(Never Queue)
5. LBLC:(Lacality-Based LC)动态的DH算法,使用场景:根据负载状态实现正向代理
6. LBLCR:(LBLC with Replication)带复制功能的LBLC,解决LBLC负载不均衡的问题,从负载重的复制到负载轻的RS

4.15版本内核以后新增调度算法

1. FO(Weighted Fai Over)调度算法：常用作灰度发布
   • 在此FO算法中，遍历虚拟服务所关联的真实服务器链表，找到还未过载(未设置IP_VS_DEST_F OVERLOAD标志)的且权重最高的真实服务器，进行调度
   • 当服务器承接大量链接，我们可以对此服务器进行过载标记（IP_VS_DEST_F OVERLOAD），那么vs调度 器就不会把链接调度到有过载标记的主机中。
2. OVF(Overflow-connection)调度算法:基于真实服务器的活动连接数量和权重值实现。将新连接调度到权重值最高的真实服务器，直到其活动 连接数量超过权重值，之后调度到下一个权重值最高的真实服务器,在此OVF算法中，遍历虚拟服务相关 联的真实服务器链表，找到权重值最高的可用真实服务器。一个可用的真实服务器需要同时满足以下条 件:
   • 未过载(未设置IP_VS_DEST_F OVERLOAD标志)
   • 真实服务器当前的活动连接数量小于其权重值
   • 其权重值不为零

ipvsadm命令

核心功能:

• ​ 集群服务管理:增删改
• 集群服务的RS管理:增删改

lvs集群中的增删改

1.管理集群服务中的增删改

ipvsadm -A|E -t|u|f service-address [-s scheduler] [-p [timeout]]

选项	说明
-A	添加
-E	修改
-t	tcp服务
-u	udp服务
-s	指定调度算法默认为WLC
-p	设置持久连接超时,持久连接可以理解为在同一个时间段同一个来源的请求调度到同一个Reslserver
-f	firewall mask火墙标记,是一个数字

2.管理集群中ReslServer的增删改查

ipvsadm -a|e -t|u|f service-address -r reslserver-address [-g|i|m] [-w weight]

选项	说明
-a	添加realserver
-e	更改realserver
-t	tcp协议
-u	udp协议
-f	火墙标记
-r	realserver地址
-g	直连路由模式
-i	ipip隧道模式
-m	nat模式
-w	设定权重
-Z	清空计数器
-C	清空lvs策略
-L	查看lvs策略
-n
–rate	输出速率信息

实操实验:

lvs-nat模拟实验

环境:

lvs:

网卡:

​ eth0:nat模式 vip:172.25.254.100/24

​ eth1:仅主机 ip:192.168.0.100/24

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.100/24,172.25.254.2
method=manual
dns=114.114.114.114
[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth1.nmconnection 
[connection]
id=eth1
type=ethernet
interface-name=eth1[ipv4]
address1=192.168.0.100/24
method=manual
[root@localhost ~]# nmcli connection reload 
[root@localhost ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@localhost ~]# nmcli connection up eth1
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5)
[root@localhost ~]# 
#查看内核路由功能是否打开
[root@localhost ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
[root@localhost ~]#
#打开内核路由功能
[root@localhost ~]# vim /etc/sysctl.conf
[root@localhost ~]# cat /etc/sysctl.conf | grep ip_forward
net.ipv4.ip_forward=1
[root@localhost ~]# 
#使设置生效
[root@localhost ~]# sysctl -p
net.ipv4.ip_forward = 1
#关闭防火墙和SELinux
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]# 
#安装ipvs软件ipvsadm
[root@localhost ~]# dnf install ipvsadm -y
#加入调度策略
#增加虚拟服务器这里没有加入权重,如果需要加入权重则需要使用wrr
[root@localhost ~]# ipvsadm -A -t 172.25.254.100:80 -s rr
#添加调度策略
[root@localhost ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.10 -m
[root@localhost ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.20 -m
[root@localhost ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:80 rr-> 192.168.0.10:80              Masq    1      0          0         -> 192.168.0.20:80              Masq    1      0          0         
[root@localhost ~]# 
#保存ipvsadm策略
[root@localhost ~]# ipvsadm -Sn /etc/sysconfig/ipvsadm-config 
[root@localhost ~]# cat /etc/sysconfig/ipvsadm-config 
-A -t 192.168.0.200:80 -s rr
-a -t 192.168.0.200:80 -r 192.168.0.10:80 -g 
-a -t 192.168.0.200:80 -r 192.168.0.20:80 -g 

webserver1

网卡:

​ eth0:仅主机 192.168.0.10 网关:192.168.0.100

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
method=manual
address=192.168.0.10/24,192.168.0.100
dns1=114.114.114.114
#重启网卡
[root@localhost ~]# nmcli connection reload 
[root@localhost ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
#查看路由
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.100   0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
#查看路由
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.25.254.2    0.0.0.0         UG    102    0        0 eth0
172.25.254.0    0.0.0.0         255.255.255.0   U     102    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     103    0        0 eth1
[root@localhost ~]# 
#下载web服务编辑配置文件以供验证
[root@localhost ~]# dnf install httpd -y
[root@localhost ~]# echo webserver1:192.168.0.10 > /var/www/html/index.html 
[root@localhost ~]# cat /var/www/html/index.html 
webserver1:192.168.0.10
#重启httpd服务关闭防火墙和SELinux,之后可以在client中使用curl+ip测试能否访问
[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]# 

webserver2

eth0:仅主机 192.168.0.20 网关:192.168.0.100

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
method=manual
address=192.168.0.20/24,192.168.0.100
dns=114.114.114.114
#重启网卡
[root@localhost ~]# nmcli connection reload 
[root@localhost ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
#查看路由
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.100   0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
[root@localhost ~]#  
#下载web服务编辑配置文件以供验证
[root@localhost ~]# dnf install httpd -y
[root@localhost ~]# echo webserver2:192.168.0.20 > /var/www/html/index.html 
[root@localhost ~]# cat /var/www/html/index.html 
webserver2:192.168.0.20
#重启httpd服务关闭防火墙和SELinux
[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]#   

clent

网卡: etho NAT模式 172.25.254.200/24

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.200/24,172.25.254.100
method=manual
[root@localhost ~]#
#在server1和server2设置完httpd后的测试,lva并没有加入ipvsadm
[root@localhost ~]# curl 192.168.0.10
webserver1:192.168.0.10
[root@localhost ~]# curl 192.168.0.20
webserver2:192.168.0.20
[root@localhost ~]# 
#在lvs中计入ipvs后的测试
[root@localhost ~]# for i in {1..10}
> do
> curl 172.25.254.100
> done
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
[root@localhost ~]# 

lvs-DR模拟实验

解决vip响应问题

在DR模型上各主机上均需要配置VIP,解决地址冲突的方式有三种:

(1),在前端网关做静态绑定

(2),在各rs使用arptables

(3),在各RS修改内核参数,来限制arp响应的通告的级别

限制响级别:arp_ignore

• 0:默认值:表示可使用本地任意接口上配置的任意地址进行响应
• 1:仅在请求的目标IP配置在本地主机的接受的请求报文的接口上时,才给予响应

限制通告级别:

• 0:默认值:把本机所有接口的所有信息向每个接口的网络进行通告
• 1:尽量避免将接口信息向非直接连接网络进行通告
• 2:必须避免将接口信息向非本网络进行通告

设备设置:

这里的web服务和lvs-nat模式的web服务一样,关闭了防火墙和SELinux

webserver1:

eth0:仅主机 192.168.0.10 网关:192.168.0.100

lo:充当vip 192.168.0.200/32

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
method=manual
address=192.168.0.10/24,192.168.0.100
dns1=114.114.114.114
#添加vip也可以添加到其他网卡中
[root@webserver1 ~]# ip a a 192.168.0.200/32 dev lo 
#重启网卡
[root@localhost ~]# nmcli connection reload 
[root@webserver1 ~]# nmcli connection up lo 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@localhost ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@webserver1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:fb:af:a1 brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.10/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::131d:4d9:4af3:d18d/64 scope link noprefixroute valid_lft forever preferred_lft forever
#查看路由
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.100   0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
#配置vip不对外响应
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore 
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce 
[root@webserver1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce 
[root@webserver1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
#配置http服务和关闭SELinux参考lvs-nat实验

webserver2:

eth0:仅主机 192.168.0.20 网关:192.168.0.100

lo:充当vip 192.168.0.200/32

[root@localhost ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
method=manual
address=192.168.0.20/24,192.168.0.100
dns=114.114.114.114
#添加vip也可以添加到其他网卡中
[root@webserver2 ~]# ip a a 192.168.0.200/32 dev lo 
#重启网卡
[root@localhost ~]# nmcli connection reload 
[root@webserver2 ~]# nmcli connection up lo
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@localhost ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@webserver2 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:c9:3d:50 brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.20/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::fa32:faf:d238:9326/64 scope link noprefixroute valid_lft forever preferred_lft forever
#查看路由
[root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.100   0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
#配置vip不对外响应
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@webserver2 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[root@webserver2 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
#配置http服务和关闭SELinux参考lvs-nat实验

lvs:

eth0:仅主机 192.168.0.50/24 gateway:192.168.0.100

lo:充当vip 192.168.0.200/32

#设置ip
[root@lvs ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address=192.168.0.50/24,192.168.0.100
method=manual
#添加vip也可以添加到其他网卡中
[root@lvs ~]# ip a a 192.168.0.200/32 dev lo 
#重启网卡
[root@localhost ~]# nmcli connection reload 
[root@lvs ~]# nmcli connection up lo 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/8)
[root@localhost ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@lvs ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet 192.168.0.200/32 scope global lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:fd:a6:ea brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 192.168.0.50/24 brd 192.168.0.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::bbb1:4d5d:560:2123/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@lvs ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.100   0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
#加入ipvsadm调度策略
[root@lvs ~]# ipvsadm -A -t 192.168.0.200:80 -s wrr
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g -w 1
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g -w 2
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.0.200:80 wrr-> 192.168.0.10:80              Route   1      0          0         -> 192.168.0.20:80              Route   2      0          0         
[root@lvs ~]# 

route:

eth0: NAT模式 172.25.254.100 gateway:172.25.254.2

eth1:仅主机模式 192.168.0.100

#配置网卡内容
[root@router ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.100/24,172.25.254.2
method=manual
dns=114.114.114.114
[root@router ~]# cat /etc/NetworkManager/system-connections/eth1.nmconnection 
[connection]
id=eth1
type=ethernet
interface-name=eth1[ipv4]
address1=192.168.0.100/24
method=manual
#重启网卡
[root@router ~]# nmcli connection reload 
[root@router ~]# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)
[root@router ~]# nmcli connection up eth1
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/7)
#查看网络信息
[root@router ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:d0:65:d2 brd ff:ff:ff:ff:ff:ffaltname enp3s0altname ens160inet 172.25.254.100/24 brd 172.25.254.255 scope global noprefixroute eth0valid_lft forever preferred_lft foreverinet6 fe80::bf7:7246:70e2:bb83/64 scope link noprefixroute valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000link/ether 00:0c:29:d0:65:dc brd ff:ff:ff:ff:ff:ffaltname enp19s0altname ens224inet 192.168.0.100/24 brd 192.168.0.255 scope global noprefixroute eth1valid_lft forever preferred_lft foreverinet6 fe80::312a:e80c:80f6:2ca0/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@router ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.25.254.2    0.0.0.0         UG    102    0        0 eth0
172.25.254.0    0.0.0.0         255.255.255.0   U     102    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     103    0        0 eth1
[root@router ~]# 
#打开内核路由
#检查是否打开了内核路由
[root@router ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
#编辑配置文件
[root@router ~]# grep ip_forward /etc/sysctl.conf 
net.ipv4.ip_forward=1
[root@router ~]# sysctl -p
net.ipv4.ip_forward = 1
[root@router ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
[root@router ~]#  

client:

eth0:NAT模式 172.25.254.200 gateway:172.25.254.100

[root@client ~]# cat /etc/NetworkManager/system-connections/eth0.nmconnection 
[connection]
id=eth0
type=ethernet
interface-name=eth0[ipv4]
address1=172.25.254.200/24,172.25.254.100
method=manual
#重启网卡
[root@client ~]# nmcli connection reload 
[root@client ~]# nmcli connection up eth0 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
[root@client ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.25.254.100  0.0.0.0         UG    100    0        0 eth0
172.25.254.0    0.0.0.0         255.255.255.0   U     100    0        0 eth0
#测试
[root@client ~]# for i in {1..10}; do curl 192.168.0.200; done
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver2:192.168.0.20
webserver1:192.168.0.10
webserver2:192.168.0.20
webserver2:192.168.0.20
webserver1:192.168.0.10
[root@client ~]#

lvs-火墙标记解决调度问题

在webserver1和webserver2安装mod_ssl模块让他们支持https

webserver1

[root@webserver1 ~]# dnf install mod_ssl -y
#重启httpd服务
[root@webserver1 ~]# systemctl restart httpd

webserver2

[root@webserver2 ~]# dnf install mod_ssl -y
#重启httpd服务
[root@webserver2 ~]# systemctl restart httpd

在lvs中追加加入调度策略

[root@lvs ~]# ipvsadm -A -t 192.168.0.200:443 -s rr
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.10:443 -g
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.20:443 -g
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.0.200:80 wrr-> 192.168.0.10:80              Route   1      0          0         -> 192.168.0.20:80              Route   2      0          0         
TCP  192.168.0.200:443 rr-> 192.168.0.10:443             Route   1      0          0         -> 192.168.0.20:443             Route   1      0          0         
[root@lvs ~]# 

未加火墙前的测试:

client

这时候前一条是正确的当时后面应该是10

[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2:192.168.0.20
webserver2:192.168.0.20
[root@client ~]# 

lvs中为端口做标记,清空ipvsadm调度策略,写入火墙的策略

[root@lvs ~]# iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         Chain INPUT (policy ACCEPT)
target     prot opt source               destination         Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
[root@lvs ~]# iptables -t mangle -A PREROUTING -d 192.168.0.200 -p tcp -m multiport --dports 80,443 -j MARK --set-mark 666
[root@lvs ~]# iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
MARK       6    --  0.0.0.0/0            192.168.0.200        multiport dports 80,443 MARK set 0x42Chain INPUT (policy ACCEPT)
target     prot opt source               destination         Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.0.200:80 wrr-> 192.168.0.10:80              Route   1      0          0         -> 192.168.0.20:80              Route   2      0          0         
TCP  192.168.0.200:443 rr-> 192.168.0.10:443             Route   1      0          0         -> 192.168.0.20:443             Route   1      0          0         
[root@lvs ~]# ipvsadm -C
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
[root@lvs ~]# ipvsadm -A -f 66 -s rr
[root@lvs ~]# ipvsadm -a -f 66 -r 192.168.0.10 -g
[root@lvs ~]# ipvsadm -a -f 66 -r 192.168.0.20 -g
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
FWM  66 rr-> 192.168.0.10:0               Route   1      0          0         -> 192.168.0.20:0               Route   1      0          0         
[root@lvs ~]#   

测试:

clietn

[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2:192.168.0.20
webserver1:192.168.0.10
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2:192.168.0.20
webserver1:192.168.0.10
[root@client ~]# curl 192.168.0.200;curl -k https://192.168.0.200
webserver2:192.168.0.20
webserver1:192.168.0.10
[root@client ~]# 

注意:

在配置vip不对外响应的时候需要永久设置的话可以使用sysctl -a | grep arp_ignore查看,把需要的内容写入到/etc/sysctl.conf中,然后再输入sysctl -p保存设定

[root@webserver1 ~]# sysctl -a | grep arp_ignore
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.lo.arp_ignore = 1
[root@webserver1 ~]#