Build LVS (NAT mode) + keepalived

There are many articles about LVS + keepalived on the Internet, but most of them are Dr-mode solutions, which are rare in Nat mode. Therefore, I would like to write a NAT-mode article here, share only and save as notes.

Network Topology:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/37/C6/wKiom1OvownSqZXPAAFB96bw4M8072.jpg "Title =" image 1.png "alt =" wkiom1ovownsqzxpaafb96bw4m8072.jpg "/>

Currently, Linux kernel supports LVS, so we can directly use Yum to install ipvsadm.

 

Yum source replacement, replace the system's yum source with 163 Yum Source

[[Email protected] ~] # Cd/etc/yum. Repos. d/

[[Email protected] yum. Repos. d] # ls

Centos-163.repo rhel-source.repo.bak

[[Email protected] yum. Repos. d] # Vim centos-163.repo.

#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=updatesgpgcheck=1gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #additional packages that may be useful[extras]name=CentOS-6 - Extras - 163.combaseurl=http://mirrors.163.com/centos/6/extras/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=extrasgpgcheck=1gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #additional packages that extend functionality of existing packages[centosplus]name=CentOS-6 - Plus - 163.combaseurl=http://mirrors.163.com/centos/6/centosplus/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=centosplusgpgcheck=1enabled=0gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #contrib - packages by Centos Users[contrib]name=CentOS-6 - Contrib - 163.combaseurl=http://mirrors.163.com/centos/6/contrib/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=contribgpgcheck=1enabled=0gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

 

LVS Software Installation

[[Email protected] yum. Repos. d] # Yum install ipvsadm-y

 

Enable route forwarding

[[Email protected] yum. Repos. d] # Vim/etc/sysctl. conf

Change net. ipv4.ip _ forward = 0 to net. ipv4.ip _ forward = 1.

 

Make the configuration take effect

[[Email protected] yum. Repos. d] # sysctl-P

Net. ipv4.ip _ forward = 1

Net. ipv4.conf. Default. rp_filter = 1

Net. ipv4.conf. Default. accept_source_route = 0

Kernel. sysrq = 0

Kernel. core_uses_pid = 1

Net. ipv4.tcp _ syncookies = 1

Kernel. msgmnb = 65536

Kernel. msgmax = 65536

Kernel. shmmax = 68719476736

Kernel. Shmall = 4294967296

Net. ipv4.ip _ local_port_range = 1024 65000

Disable built-in firewall and SELinux policies

[[Email protected] yum. Repos. d] # iptables-F

Chain input (Policy accept)

Target prot opt source destination

 

Chain forward (Policy accept)

Target prot opt source destination

 

Chain output (Policy accept)

Target prot opt source destination

[[Email protected] yum. Repos. d] # iptables-T nat-F

Chain prerouting (Policy accept)

Target prot opt source destination

 

Chain postrouting (Policy accept)

Target prot opt source destination

 

Chain output (Policy accept)

Target prot opt source destination

[[Email protected] yum. Repos. d] # setenforce 0

 

Install and configure keepalived

Because the gateway of the nat-mode RealServer is the IP address of the Server Load balancer. Therefore, the gateway should be able to switch along with the switch of the Internet VIP. Here, we will define a vrrp group, an inside_network, and an outside_network. the inside_network VIP serves as the RealServer gateway address, and the outside_network VIP serves as the Internet access address.

[[Email protected] # wget http://www.keepalived.org/software/keepalived-1.2.4.tar.gz

[[Email protected] # tar xf keepalived-1.2.4.tar.gz

[[Email protected] # Yum install GCC * OpenSSL * popt-devel libnl *

[[Email protected] # cd keepalived-1.2.4

[[Email protected] keepalived-1.2.4] #./configure prefix =/usr/local/keepalived

[[Email protected] keepalived-1.2.4] # Make; make install

[[Email protected] keepalived-1.2.4] # cd/usr/local/keepalived/etc/keepalived

[[Email protected] keepalived-1.2.4] # cp keepalived. conf keepalived. conf_bak

[[Email protected] keepalived-1.2.4] # cp/usr/local/keepalived/etc/sysconfig

[[Email protected] keepalived] # Vim/etc/keepalived. conf

 

! Configuration file for keepalivedglobal_defs {icationication_email {[email protected] # address for receiving emails during master/backup switch, one [email protected]} notification_email_from # specify the mail source smtp_server 127.0.0.1 # use the local mail server smtp_connect_timeout 30 # specify the mail connection timeout router_id lvs_master # specify the router_id identifier, the master and slave nodes can be the same or different} vrrp_syncv_group swj {# define a virtual routing group {inside_networkoutside_network} vrrp_instance outside_network {state master # Set the master LVS load as the master node, backup: backupinterface eth0 # Set the VIP listener Nic track_interface {# define an additional listener Nic, if one of the NICS fails, the Master/Slave switchover will occur. # eth0eth1} lvs_sync_daemon_inteface eth0 # Set the virtual_router_id 100 # Set the virtual route ID number of the NIC, the ID number of the same group of primary and secondary nodes must be the same priority 100 # set the priority. The master priority is higher than that of the backup node. advert_int 1 # sets the vrrp detection time. The default value is 1 sauthentication {# Sets authentication information, the master and slave nodes must be the same as auth_type passauth_pass 1111} virtual_ipaddress {region/26 # Set the Internet VIP} vrrp_instance inside_network {state masterinterface eth1track_interface {eth0 # eth1} region limit 50 priority limit 1 auth 1111} virtual_ipaddress {192.168.1.21/24 # Set the gateway address to intranet VIP} virtual_server 10.204.172.2 9912 {# Set the policy VIP + port delay_loop 6lb_algo RR # Set the policy, here is the round-robin mode, you can also set it to WRR or other lb_kind Nat # To the NAT mode. If the Dr mode is changed to Dr mode, nat_mask must have reached 192 # persistence_timeout 50 # comment here, otherwise, the same backend server protocol tcpreal_server 192.168.1.32 9912 {# Set the Real Server IP address + port weight 1tcp_check {connect_timeout 3nb_get_retry ipv3connect_port 9912 # Set the connection port} real_server 192.168.1.31 {weight 1tcp_check {connect_timeout 3nb_get_retry 3delay_before_retry 3connect_port 9912 }}}

 

Start the keepalived service after the configuration.

[[Email protected] ~] #/Etc/init. d/keepalived restart
Stopping keepalived: [OK]
Starting keepalived: [OK]

View the IP address of the master LVS

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/37/C6/wKiom1Ovo7Gh2pu2AASPNwZoLHI220.jpg "Title =" qq2.png "alt =" wkiom1ovo7gh2pu2aaspnwzolhi220.jpg "/>

View the IP address of the standby LVS

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/37/C5/wKioL1OvoR7y9CZiAALClyYPsTg576.jpg "Title =" image 2.png "alt =" wkiol1ovor7y9cziaalclyypstg576.jpg "/>

View the LVS load:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/37/C6/wKiom1OvpI2CSkVKAAED3VUQzjU484.jpg "Title =" qq .jpg "alt =" wkiom1ovpi2cskvkaaed3vuqzju484.jpg "/>

View logs

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/37/C5/wKioL1OvpOaCMuXkAAPhBRioV04352.jpg "Title =" qq2014062.png "alt =" wkiol1ovpoacmuxkaaphbriov04352.jpg "/>

If the master device fails, ifdown eth0 or disable the keepalived Service

The VIP will be switched to the backup load.

Access requests can be forwarded normally:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/37/C6/wKiom1OvpfGA_LL3AACsDuuJEyk417.jpg "Title =" qqtu.jpg "alt =" wkiom1ovpfga_ll3aacsduujeykw.jpg "/>

 

This article from the "poor path-the beginning of the Heart" blog, please be sure to keep this source http://aixocm.blog.51cto.com/4208464/1432064