NAT模式
image.png
- on LVS开启forward
# vim /etc/sysctl.conf
net.ipv4.ip_forward=1
sysctl -p
net.ipv4.ip_forward = 1
- 安装lvs工具ipvsadm
yum install ipvsadm
NAT模式LVS
- 创建LVS集群
[root@lvs ~]# ipvsadm -A -t 172.16.0.12:80 -s rr
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.16.0.12:80 rr
- 添加rs
[root@lvs ~]# ipvsadm -a -t 172.16.0.12:80 -r 192.168.80.13 -m
[root@lvs ~]# ipvsadm -a -t 172.16.0.12:80 -r 192.168.80.14 -m
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.16.0.12:80 rr
-> 192.168.80.13:80 Masq 1 0 0
-> 192.168.80.14:80 Masq 1 0 0
[root@lvs ~]# ipvsadm -Ln --stats
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Conns InPkts OutPkts InBytes OutBytes
-> RemoteAddress:Port
TCP 172.16.0.12:80 0 0 0 0 0
-> 192.168.80.13:80 0 0 0 0 0
-> 192.168.80.14:80 0 0 0 0 0
[root@lvs ~]# ipvsadm -Ln --rate
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port CPS InPPS OutPPS InBPS OutBPS
-> RemoteAddress:Port
TCP 172.16.0.12:80 0 0 0 0 0
-> 192.168.80.13:80 0 0 0 0 0
-> 192.168.80.14:80 0 0 0 0 0
[root@lvs ~]# cat /proc/net/ip_vs
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP AC10000C:0050 rr
-> C0A8500E:0050 Masq 1 0 0
-> C0A8500D:0050 Masq 1 0 0
[root@lvs ~]# cat /proc/net/ip_vs_conn
Pro FromIP FPrt ToIP TPrt DestIP DPrt State Expires PEName PEData
在客户端测试
while true; do curl 172.16.0.12; sleep 0.5; done改变权重
[root@lvs ~]# ipvsadm -E -t 172.16.0.12:80 -s wrr
[root@lvs ~]# ipvsadm -e -t 172.16.0.12:80 -r 192.168.80.13 -m -w 6
[root@lvs ~]# ipvsadm -e -t 172.16.0.12:80 -r 192.168.80.14 -m -w 2
- 改变端口号
ipvsadm -a -t 172.16.0.12:80 -r 192.168.80.14:8080 -m -w 2
- 改变调度算法
ipvsadm -E -t 172.16.0.12:80 -s sh
ipvsadm -E -t 172.16.0.12:80 -s dh
# 恢复默认调度算法wlc
ipvsadm -E -t 172.16.0.12:80
DR模式
image.png
- 配置router
net.ipv4.ip_forward=1
- 配置LVS
ip a a 192.168.80.100/24 dev eth0
ipvsadm -A -t 192.168.80.100:80 -s rr
ipvsadm -a -t 192.168.80.100:80 -r 192.168.80.13
ipvsadm -a -t 192.168.80.100:80 -r 192.168.80.14
[root@80_15 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.37.100:80 rr
-> 192.168.80.13:80 Route 1 0 0
-> 192.168.80.14:80 Route 1 0 0
- 配置RS
配置脚本
#!/bin/bash
vip=192.168.80.100
mask='255.255.255.255'
dev=lo:1
case $1 in
start)
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
ifconfig $dev $vip netmask $mask #broadcast $vip up
#route add -host $vip dev $dev
;;
stop)
ifconfig $dev down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
;;
*)
echo "Usage: $(basename $0) start|stop"
exit 1
;;
esac
DR 模式下DIP，VIP和RIP不在同一网段配置
image.png
- Router
vim /etc/sysctl.conf
net.ipv4.ip_forward=1
ip a a 10.0.0.200/8 dev eth0
[root@80_12 network-scripts]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.80.2 0.0.0.0 UG 100 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
172.16.0.0 0.0.0.0 255.255.0.0 U 101 0 0 eth1
192.168.80.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
- LVS
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet 10.0.0.100/32 scope global lo:1
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
#!/bin/bash
vip='10.0.0.100'
iface='lo:1'
mask='255.255.255.255'
port='80'
rs1='192.168.80.13'
rs2='192.168.80.14'
scheduler='wrr'
type='-g'
case $1 in
start)
ifconfig $iface $vip netmask $mask #broadcast $vip up
iptables -F
ipvsadm -A -t ${vip}:${port} -s $scheduler
ipvsadm -a -t ${vip}:${port} -r ${rs1} $type -w 1
ipvsadm -a -t ${vip}:${port} -r ${rs2} $type -w 1
;;
stop)
ipvsadm -C
ifconfig $iface down
;;
*)
echo "Usage $(basename $0) start|stop"
exit 1
esac
- RS
#!/bin/bash
vip=10.0.0.100
mask='255.255.255.255'
dev=lo:1
case $1 in
start)
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
ifconfig $dev $vip netmask $mask #broadcast $vip up
#route add -host $vip dev $dev
;;
stop)
ifconfig $dev down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
;;
*)
echo "Usage: $(basename $0) start|stop"
exit 1
;;
esac
使用贴标签模式，实现多port统一调度
example：支持https调度
使用iptables贴标签, 将80和443都mark成10
iptables -t mangle -A PREROUTING -d 10.0.0.100 -p tcp -m multiport --dports 80,443 -j MARK --set-mark 10
定义标签为10的调度策略
[root@80_15 ~]# ipvsadm -A -f 10 -s rr
[root@80_15 ~]# ipvsadm -a -f 10 -r 192.168.80.13
[root@80_15 ~]# ipvsadm -a -f 10 -r 192.168.80.14
[root@80_15 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
FWM 10 rr
-> 192.168.80.13:0 Route 1 0 0
-> 192.168.80.14:0 Route 1 0 0
持久链接
[root@80_15 ~]# ipvsadm -E -f 10 -s rr -p
[root@80_15 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
FWM 10 rr persistent 360
-> 192.168.80.13:0 Route 1 0 0
-> 192.168.80.14:0 Route 1 0 0