LVS实战：NAT模式搭建HTTP和HTTPS负载均衡集群
文章目录
- 项目环境
- 搭建HTTP负载均衡集群
-
- 1. 在Client上配置CIP，模拟公网地址
- 2. 在DR上配置DIP和VIP
- 3. 在DR上开启IP转发，配置转发规则
- 4. 在RS上配置RIP，并将网关指向DIP
- 5. 在RS上配置HTTP
- 6. 客户端访问验证
- 搭建HTTPS负载均衡集群
-
- 1. 生成证书
- 2. 配置HTTPS
- 3. 在DR上配置规则
- 4. 客户端访问验证
项目环境
拓扑：
这里将主机DR的VIP网卡和Client上的CIP网卡设置为仅主机模式，来模拟公网地址；其他网卡均为NAT模式，来模拟内网
搭建HTTP负载均衡集群
1. 在Client上配置CIP，模拟公网地址
2. 在DR上配置DIP和VIP
//配置VIP
[root@DR ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens36
//添加以下内容
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
NAME=ens36
DEVICE=ens36
ONBOOT=yes
IPADDR=172.25.100.2
NETMASK=255.255.255.0
GATEWAY=172.25.100.1 //这里为了模拟公网，所以直接将网关指向了CIP，正常情况下应该指向路由器
DNS1=172.25.100.1
[root@DR ~]# systemctl restart network
[root@DR ~]# ip a s ens36
3: ens36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:97:c3:70 brd ff:ff:ff:ff:ff:ff
inet 172.25.100.2/24 brd 172.25.100.255 scope global noprefixroute ens36
//查看是否能够和CIP互通
[root@DR ~]# ping 172.25.100.1
PING 172.25.100.1 (172.25.100.1) 56(84) bytes of data.
64 bytes from 172.25.100.1: icmp_seq=1 ttl=64 time=0.911 ms
64 bytes from 172.25.100.1: icmp_seq=2 ttl=64 time=0.593 ms
//DIP和上面一样直接修改配置文件
[root@DR ~]# ip a s ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:97:c3:66 brd ff:ff:ff:ff:ff:ff
inet 192.168.207.129/24 brd 192.168.207.255 scope global noprefixroute ens33
3. 在DR上开启IP转发，配置转发规则
//开启IP转发
[root@DR ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1 //添加此行
[root@DR ~]# sysctl -p
net.ipv4.ip_forward = 1
//配置规则
[root@DR ~]# yum -y install ipvsadm
[root@DR ~]# ipvsadm -A -t 172.25.100.2:80 -s rr
[root@DR ~]# ipvsadm -a -t 172.25.100.2:80 -r 192.168.207.130:80 -m
[root@DR ~]# ipvsadm -a -t 172.25.100.2:80 -r 192.168.207.131:80 -m
[root@DR ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
//查看规则
[root@DR ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.100.2:80 rr
-> 192.168.207.130:80 Masq 1 0 0
-> 192.168.207.131:80 Masq 1 0 0
4. 在RS上配置RIP，并将网关指向DIP
[root@RS1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
NAME=ens33
UUID=1e3c84a0-9777-4fbb-8202-5ae16a3f1821
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.207.130
NETMASK=255.255.255.0
GATEWAY=192.168.207.129
DNS1=192.168.207.129
[root@RS1 ~]# systemctl restart network
[root@RS1 ~]# ip a s ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:2d:e0:d6 brd ff:ff:ff:ff:ff:ff
inet 192.168.207.130/24 brd 192.168.207.255 scope global noprefixroute ens33
[root@RS2 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE=Ethernet
PROXY_METHOD=none
BOOTPROTO=static
NAME=ens33
UUID=79cbe2f4-e2f3-4309-a468-d23f9c61dcc6
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.207.131
NETMASK=255.255.255.0
GATEWAY=192.168.207.129
DNS1=192.168.207.129
[root@RS2 ~]# systemctl restart network
[root@RS2 ~]# ip a s ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:f8:68:04 brd ff:ff:ff:ff:ff:ff
inet 192.168.207.131/24 brd 192.168.207.255 scope global ens33
5. 在RS上配置HTTP
[root@RS1 ~]# yum -y install httpd
[root@RS1 ~]# cd /var/www/html/
[root@RS1 html]# echo 'RS--1' > index.html
[root@RS1 html]# systemctl start httpd
[root@RS2 ~]# yum -y install httpd
[root@RS2 ~]# cd /var/www/html/
[root@RS2 html]# echo 'RS--2' > index.html
[root@RS2 html]# systemctl start httpd
6. 客户端访问验证
搭建HTTPS负载均衡集群
1. 生成证书
生成一对秘钥
[root@DR ~]# cd /etc/pki/CA
[root@DR CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.............+++
..+++
e is 65537 (0x10001)
生成自签署证书
[root@DR CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:aaa.com
Organizational Unit Name (eg, section) []:aaa.com
Common Name (eg, your name or your server's hostname) []:aaa.com
Email Address []:[email protected]
[root@DR CA]# touch index.txt && echo 01 > serial
在RS生成证书签署请求，并发送给CA
[root@RS1 ~]# mkdir /etc/httpd/ssl
[root@RS1 ~]# cd /etc/httpd/ssl/
[root@RS1 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
..................+++
...................................................................+++
e is 65537 (0x10001)
[root@RS1 ssl]# openssl req -new -key httpd.key -days 1024 -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:aaa.com
Organizational Unit Name (eg, section) []:aaa.com
Common Name (eg, your name or your server's hostname) []:aaa.com
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@RS1 ssl]# ls
httpd.csr httpd.key
[root@RS1 ssl]# scp httpd.csr [email protected]:/root
CA签署证书并发给客户端
[root@DR ~]# ls
httpd.csr
[root@DR ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 24 13:15:07 2020 GMT
Not After : Jul 24 13:15:07 2021 GMT
Subject:
countryName = CN
stateOrProvinceName = HB
organizationName = aaa.com
organizationalUnitName = aaa.com
commonName = aaa.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
B5:D7:DC:0C:4C:84:F9:7B:3D:B4:7C:10:CD:96:87:C8:87:56:47:FD
X509v3 Authority Key Identifier:
keyid:1B:FE:4E:5C:52:2F:11:4C:E2:66:73:9E:DD:77:8C:F1:8E:E3:9E:54
Certificate is to be certified until Jul 24 13:15:07 2021 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@DR ~]# ls
httpd.crt httpd.csr
CA把签署好的证书httpd.crt和服务端的证书cacert.pem发给客户端
[root@DR ~]# scp httpd.crt [email protected]:/etc/httpd/ssl
[root@DR ~]# scp /etc/pki/CA/cacert.pem [email protected]:/etc/httpd/ssl
[root@RS2 ~]# mkdir /etc/httpd/ssl
[root@DR ~]# scp httpd.crt [email protected]:/etc/httpd/ssl
[root@DR ~]# scp /etc/pki/CA/cacert.pem [email protected]:/etc/httpd/ssl
2. 配置HTTPS
在RS1上将httpd.key传给RS2,并在RS上安装ssl模块
[root@RS1 ssl]# ls
cacert.pem httpd.crt httpd.key
[root@RS1 ssl]# scp httpd.key [email protected]:/etc/httpd/ssl
[root@RS1 ssl]# yum -y install mod_ssl
//RS2上查看是否拥有证书和秘钥
[root@RS2 ssl]# ls
cacert.pem httpd.crt httpd.key
[root@RS2 ssl]# yum -y install mod_ssl
在RS上编辑配置文件
[root@RS1 ~]# vim /etc/httpd/conf.d/ssl.conf
<VirtualHost _default_:443>
# General setup for the virtual host, inherited from global configuration
//将下面两行删除注释，并修改域名
DocumentRoot "/var/www/html"
ServerName aaa.com:443
...
//修改下面没有带注释的行
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/httpd/ssl/httpd.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
...
...
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
SSLCACertificateFile /etc/httpd/ssl/cacert.pem
[root@RS1 ~]# systemctl restart httpd
//RS2上的配置和上面的一样，这里就不做演示了
3. 在DR上配置规则
[root@DR ~]# ipvsadm -A -t 172.25.100.2:443 -s rr
[root@DR ~]# ipvsadm -a -t 172.25.100.2:443 -r 192.168.207.130 -m
[root@DR ~]# ipvsadm -a -t 172.25.100.2:443 -r 192.168.207.131 -m
[root@DR ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@DR ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.100.2:80 rr
-> 192.168.207.130:80 Masq 1 0 0
-> 192.168.207.131:80 Masq 1 0 0
TCP 172.25.100.2:443 rr
-> 192.168.207.130:443 Masq 1 0 0
-> 192.168.207.131:443 Masq 1 0 0
4. 客户端访问验证
