Introduction to the persistent connection of LVS load Balancing (Session chapter)

In the actual production environment, it is often necessary to set the session time-out time of LVS according to the business application scenario and the problem of preventing the connection loss of the session, such as in the business payment link, if the session is lost can lead to repeated deduction problem, seriously affect the security, This section of the solution will talk about the LVS persistent connection problem

I. LVS load Balancing Persistent connection description:

Intro (case)

For e-commerce sites, users in the selection of goods when the use of 80 port to browse, when the payment is through 443 SSL encryption, of course, when the user selects the product payment, we certainly do not want HTTPS 443 jump to another real server, Obviously it should be the same real server, this time use a persistent connection based on the firewall tag, by defining the affinity of the port to achieve. The most common use in a production environment is PNMP, a persistent connection that is based on a firewall tag. All right, here's the intro. Let's talk about the long-lasting connection of LVS ...

(1) The persistent connection of LVS has two aspects:

1. Record the request information of the same client to the hash table of LVS, save time using Persistence_timeout control, in seconds. The persistence_granularity parameter is in conjunction with Persistence_timeout, which is especially useful in some cases where his value is the subnet mask, which indicates the granularity of the persistent connection, the default is 255.255.255.255, which is a separate client IP, if changed to, 255.255.255.0 is the client IP a network segment will be assigned to the same real server.

2. Timeout for idle When a connection is created, this time is 3 kinds

Idle timeout time for ①tcp

②lvs received client TCP fin time-out

③UDP Time-out

(2) LVs related timeout period view:

1. "Ipvsadm-ln" to view persistence_timeout Timeout (default time-out 360s)

[Email protected] ~]# IPVSADM-LN
IP Virtual Server version 1.2.1 (size=4096)
Prot Localaddress:port Scheduler Flags
Remoteaddress:port Forward Weight activeconn inactconn
TCP 172.51.96.105:80 RR Persistent 360

2. "Ipvsadm-ln--timeout" allows you to view The timeout period for TCP Tcpfin UDP (default : +)

[Email protected] ~]# Ipvsadm-ln--timeout
Timeout (TCP Tcpfin UDP): 900 120 300

(3) How LVS controls these time-out jobs

[Email protected] ~]# ipvsadm-ln-c
IPVS Connection Entries
Pro Expire State source virtual destination
TCP 01:59 fin_wait 172.51.96.1:54196 172.51.96.105:80 192.168.0.235:80
TCP 05:54 NONE 172.51.96.1:0 172.51.96.105:80 192.168.0.235:80

When a client accesses the VIP, the Ipvs will record a message with a status of none, as shown above, the expire initial value is: Persistence_timeout value, and then according to the clock primary key is smaller, during the existence of the following record, the same client IP connections come up and are assigned to the same back end.

The value of fin_wait is the timeout of Tcpfin in TCP Tcpfin UDP, when the value of none is 0 o'clock and if fin_wait is present, then the value of none will be changed from new to Persistence_timeout , and then reduced Until Fin_wait disappears, none disappears, as long as none exists, the same client access is assigned to the unified Real server.

(4) LVS settings for the relevant timeout period

1. Persistence_timeout can be set by "Ipvsadm-p Timeout", Default 360 seconds

Ipvsadm-a-T 192.168.20.154:80-s rr-p 60

Note: The red labeled 80 port in the above command, which represents the same client Access server's 80 port, will be defined to the same real server, if the 80 port is changed to 0, then any service of the same client Access server will be forwarded to the same real server.

Modify the Keepalived configuration file and add Persistence_timeout 60 below the virtual server configuration

2. TCP Tcpfin UDP can be set by "Ipvsadm--set corresponding time-out"

Ipvsadm--set TCP Tcpfin UDP

Recommendation: The value of Tcpfin is better than the value of persistence_timeout, so it is convenient to calculate, but also conducive to tcpfin recovery

(5) Definition and principle of persistent connection

1. Definition

Persistent connections means that, regardless of the algorithm used, the LVS can be persisted for a certain period of time and will be dispatched from the same client request to the previously selected Rs.

2. Principle

When using LVS persistence, the director uses a connection internally based on records called "Persistent connection templates" to ensure that all requests from the same client are distributed to the same real server.

Description: The persistent connection template refers to the mapping relationship of each client and RS assigned to it;

3. Persistent Connection classification

(1). Persistent port connection, simply called PPC (Persistent Port Connections): The request from the same client to a service in the same cluster is always directed to the previously selected RS;

For example: client---->LVS---->rs1 or client---->LVS---->RS2

Defect: It is not possible to expect access to different ports on the same Rs.

Configuration:

Ipvsadm-a-T 172.16.100.1:80-s rr-p 3600ipvsadm-a-T 172.16.100.1:80-r 172.16.100.10-g-W 2ipvsadm-a-t 172.16.100. 1:80-r 172.16.100.11-g-W 2

(2). Persistent client connection, referred to as PCC (persistent client Connections): Requests from the same client for all ports are always directed to the previously selected RS;

Description: PCC is a virtual service that does not have a port number (or a port number of 0) and "-P" to identify the service.

Flaw: Directs all services and expects access to different real servers that cannot be implemented.

Configuration:

Ipvsadm-a-T 172.16.100.1:0-S Rr-p 3600ipvsadm-a-T 172.16.100.1:0-R 172.16.100.10-g-W 2ipvsadm-a-t 172.16.100.1: 0-r 172.16.100.11-g-W 2

(3). PNMPP (persistent netfilter Marked Packet persistence): A persistent connection that sets up port bindings based on a firewall, such as a background realserver that provides both 80 and 443 port services, and two services that are connected to each other. The PNMPC will be used at this time.

Tag a particular type of packet before sending a service based on a class of tokens to a real server in the background, which is not recognized by real servers in the background. By combining persistent and firewall tags, you can implement port-in-affinity functionality, as long as access to a particular service (requiring a different port) from a client is defined to the same real server.

Case: When a user accesses a shopping site using both HTTP (80) and HTTPS (443) protocols, we need to define it on the same real server, while other services are not restricted.

Configuration:

Iptables-t mangle-a prerouting-d 172.16.100.1-i eth0-p tcp--dport 80-j MARK--set-mark 8iptables-t mangle-a PRERO uting-d 172.16.100.1-i eth0-p tcp--dport 443-j MARK--set-mark 8ipvsadm-a-F 8-s rr-p 600ipvsadm-a-F 8-r 172.16 .100.10-g-W 2ipvsadm-a-F 8-r 172.16.100.11-g-W 1

Summary: The LVS persistent connection needs to be selected according to the business scenario, such as the e-commerce platform, the corresponding persistent connection should be pnmpp, in addition to the connection type, such as long connection and short connection, to set the relevant timeout time, in short, according to the application scenario to choose!

Introduction to the persistent connection of LVS load Balancing (Session chapter)