生产环境之负载均衡LVS+keepalived方案(4)_方案部署
DR模式
网络拓扑
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-bq1OQe3z-1685415968316)(image/2023-05-17-12-01-02.png)]
PS: 由于markdown对图片支持的缺陷，如想查看对应的图片可至博客:
https://blog.csdn.net/zhjuan
查看下载对应的pdf文档。
部署步骤
第一步 LVS两台主机配置
keepalived配置文件位置： /etc/keepalived/keepalived.conf
LVS的master主机：
! Configuration File for keepalived
global_defs {
router_id LVS_01
}
vrrp_instance VI_1 {
state MASTER
interface enp5s0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.2/24
}
}
vrrp_instance VI_2 {
state BACKUP
interface enp5s0
virtual_router_id 61
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.3/24
}
}
virtual_server 192.168.200.2 22 {
delay_loop 6
lb_algo wrr
lb_kind DR
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.200.102 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.200.103 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
virtual_server 192.168.200.3 22 {
delay_loop 6
lb_algo wrr
lb_kind DR
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.200.102 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.200.103 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
LVS的backup主机：
! Configuration File for keepalived
global_defs {
router_id LVS_02
}
vrrp_instance VI_1 {
state BACKUP
interface enp5s0
virtual_router_id 51
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.2/24
}
}
vrrp_instance VI_2 {
state MASTER
interface enp5s0
virtual_router_id 61
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.3/24
}
}
virtual_server 192.168.200.2 22 {
delay_loop 6
lb_algo wrr
lb_kind DR
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.200.102 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.200.103 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
virtual_server 192.168.200.3 22 {
delay_loop 6
lb_algo wrr
lb_kind DR
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.200.102 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.200.103 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
第二步 两台真实服务器配置
（1） 两台真实业务服务器中/etc/sysctl.conf文件添加内容
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
运行命令：
sysctl -p
生效上面配置
（2）两台真实服务器文件夹 /etc/sysconfig/network-scripts 中创建文件 ifcfg-lo:0 及 ifcfg-lo:1
ifcfg-lo:0文件内容：
DEVICE=lo:0
BOOTPROTO=static
IPADDR=192.168.200.2
NETMASK=255.255.255.255
ONBOOT=yes
ifcfg-lo:1文件内容：
DEVICE=lo:1
BOOTPROTO=static
IPADDR=192.168.200.3
NETMASK=255.255.255.255
ONBOOT=yes
运行命令：
ifup ifcfg-lo:0
ifup ifcfg-lo:1
启动网卡。
以上（1）（2）的目的：
为了让真实服务器能够响应目的地址为虚拟IP地址（VIP）的数据包，同时避免跟LVS主机生效的VIP产生arp冲突。
(3) 添加路由
两台真实服务器分别运行如下命令添加路由：
route add -host 192.168.200.2 dev lo:0
route add -host 192.168.200.3 dev lo:1
并将两条命令添加到文件 /etc/rc.local 中，以让机器启动即运行以上两条命令。
第三步 启动LVS服务
在LVS的两台主机分别运行命令：
···
service keepalived start
···
启动服务。
可运行命令查看启动的状态：
[root@node1 keepalived]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.200.2:22 wrr
-> 192.168.200.102:22 Masq 1000 0 0
-> 192.168.200.103:22 Masq 1000 0 0
TCP 192.168.200.3:22 wrr
-> 192.168.200.102:22 Masq 1000 0 0
-> 192.168.200.103:22 Masq 1000 0 0
如上生效了流量通过LVS虚拟IP（192.168.200.2:22 及 192.168.200.3:22） 到 真实服务 (192.168.200.102:22 及 192.168.200.103:22) 的分发。
NAT模式
网络拓扑
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-dHVcrvzS-1685415968318)(image/2023-05-17-14-54-50.png)]
PS: 由于markdown对图片支持的缺陷，如想查看对应的图片可至博客:
https://blog.csdn.net/zhjuan
查看下载对应的pdf文档。
部署步骤
第一步 LVS两台主机配置
（1）keepalived.conf文件配置
keepalived配置文件位置： /etc/keepalived/keepalived.conf
LVS的master主机：
! Configuration File for keepalived
global_defs {
router_id LVS_01
}
#vrrp_sync_group VG1 {
# group {
# VI_1
# lan_gw1
# }
#}
vrrp_instance VI_1 {
state MASTER
interface enp5s0
lvs_sync_daemon_inteface enp5s0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.2/24
}
}
vrrp_instance VI_2 {
state BACKUP
interface enp5s0
virtual_router_id 61
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.3/24
}
}
vrrp_instance lan_gw {
state MASTER
interface enp6s0
virtual_router_id 81
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.0.46/24
}
}
virtual_server 192.168.200.2 22 {
delay_loop 6
lb_algo wrr
lb_kind FNAT
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.0.32 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.0.44 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
virtual_server 192.168.200.3 22 {
delay_loop 6
lb_algo wrr
lb_kind NAT
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.0.32 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.0.44 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
LVS的backup主机：
! Configuration File for keepalived
global_defs {
router_id LVS_02
}
#vrrp_sync_group VG1 {
# group {
# VI_1
# lan_gw1
# }
#}
vrrp_instance VI_1 {
state BACKUP
interface enp5s0
lvs_sync_daemon_inteface enp5s0
virtual_router_id 51
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.2/24
}
}
vrrp_instance VI_2 {
state MASTER
interface enp5s0
virtual_router_id 61
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.3/24
}
}
vrrp_instance lan_gw {
state BACKUP
interface enp6s0
virtual_router_id 81
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.0.46/24
}
}
virtual_server 192.168.200.2 22 {
delay_loop 6
lb_algo wrr
lb_kind FNAT
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.0.32 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.0.44 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
virtual_server 192.168.200.3 22 {
delay_loop 6
lb_algo wrr
lb_kind NAT
nat_mask 255.255.255.0
#persistence_timeout 50
protocol TCP
real_server 192.168.0.32 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.0.44 22 {
weight 1000
TCP_CHECK {
connect_port 22
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
（2） sysctl.conf配置
文件位置： /etc/sysctl.conf
文件中添加：
net.ipv4.ip_forward = 1
运行命令：
sysctl -p
生效上面配置
以允许数据包转发。
第二步 两台真实服务器配置
将两台真实服务器的网关配置为虚拟IP： 192.168.0.46
第三步 启动LVS服务
在LVS的两台主机上分别运行命令：
···
service keepalived start
···
启动服务。
可运行命令查看启动的状态：
[root@node1 keepalived]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.200.2:22 wrr
-> 192.168.0.32:22 Masq 1000 0 0
-> 192.168.0.44:22 Masq 1000 0 0
TCP 192.168.200.3:22 wrr
-> 192.168.0.32:22 Masq 1000 0 0
-> 192.168.0.44:22 Masq 1000 0 0
如上生效了流量通过LVS虚拟IP（192.168.200.2:22 及 192.168.200.3:22） 到 真实服务 (192.168.0.32:22 及 192.168.0.44:22) 的分发。