lVS(nat模式)+keepalived搭建

標籤：lvs nat keepalived

        關於網上lvs+keepalived的文章很多，但是多數都是DR模式的方案，對於 nat模式的並不多見，因此，在此寫一份nat模式的文章，僅供分享也當筆記儲存。

網路拓撲結構：

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M02/37/C6/wKiom1OvownSqZXPAAFB96bw4M8072.jpg" title="圖片1.png" alt="wKiom1OvownSqZXPAAFB96bw4M8072.jpg" />

現在的Linux系統核心都是支援lvs的，所以我們直接可以用yum安裝ipvsadm

 

yum 源的替換，將系統的yum源替換成163的yum源

[[email protected] ~]# cd /etc/yum.repos.d/

[[email protected] yum.repos.d]# ls

centos-163.repo  rhel-source.repo.bak

[[email protected] yum.repos.d]# vim centos-163.repo 

#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=updatesgpgcheck=1gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #additional packages that may be useful[extras]name=CentOS-6 - Extras - 163.combaseurl=http://mirrors.163.com/centos/6/extras/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=extrasgpgcheck=1gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #additional packages that extend functionality of existing packages[centosplus]name=CentOS-6 - Plus - 163.combaseurl=http://mirrors.163.com/centos/6/centosplus/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=centosplusgpgcheck=1enabled=0gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 #contrib - packages by Centos Users[contrib]name=CentOS-6 - Contrib - 163.combaseurl=http://mirrors.163.com/centos/6/contrib/$basearch/#mirrorlist=http://mirrorlist.centos.org/?release=6&arch=$basearch&repo=contribgpgcheck=1enabled=0gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

 

LVS軟體的安裝

[[email protected] yum.repos.d]# yum install ipvsadm -y

 

開啟路由轉寄功能

[[email protected] yum.repos.d]# vim /etc/sysctl.conf

將net.ipv4.ip_forward = 0改成net.ipv4.ip_forward = 1

 

使配置生效

[[email protected] yum.repos.d]# sysctl -p

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

net.ipv4.ip_local_port_range = 1024 65000

關閉系統內建防火牆和selinux策略

[[email protected] yum.repos.d]# iptables -F

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

 

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination         

 

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination         

[[email protected] yum.repos.d]# iptables -t nat -F

Chain PREROUTING (policy ACCEPT)

target     prot opt source               destination         

 

Chain POSTROUTING (policy ACCEPT)

target     prot opt source               destination         

 

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination         

[[email protected] yum.repos.d]# setenforce 0

 

keepalived安裝和配置

由於nat模式的realserver的網關為負載伺服器的IP。所以做主備的時候，網關也要能跟隨外網VIP的切換一同切換，在這裡，我們將定義一個vrrp組，一個inside_network,一個outside_network. inside_network的VIP作為RealServer網關地址，outside_network的VIP作為外網訪問地址

[[email protected]]#wget http://www.keepalived.org/software/keepalived-1.2.4.tar.gz

[[email protected]]# tar xf keepalived-1.2.4.tar.gz

[[email protected]]# yum install gcc*  openssl*  popt-devel  libnl*

[[email protected]]# cd keepalived-1.2.4

[[email protected]  keepalived-1.2.4]# ./configure  prefix=/usr/local/keepalived

[[email protected]  keepalived-1.2.4]# make;make install

[[email protected]  keepalived-1.2.4]# cd /usr/local/keepalived/etc/keepalived

[[email protected]  keepalived-1.2.4]# cp keepalived.conf  keepalived.conf_bak

[[email protected]  keepalived-1.2.4]#cp /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig

[[email protected] keepalived]# vim /etc/keepalived/keepalived.conf

 

! Configuration File for keepalivedglobal_defs {notification_email {[email protected]  #主備切換時候收郵件的地址,一行一個[email protected]           }notification_email_from   #指定郵件的來源smtp_server 127.0.0.1    #使用本地郵件伺服器smtp_connect_timeout 30   #指定郵件連線逾時時間router_id LVS_MASTER      #指定router_id標識符 ，主備的可以相同，也可以不相同}vrrp_syncv_group SWJ {    #定義一個虛擬路由群組  group {inside_networkoutside_network}}vrrp_instance outside_network {state MASTER   #設定主lvs負載為master ，備用的為BACKUPinterface eth0  #設定VIP的監聽網卡 track_interface {  #定義額外的監聽網卡，只要其中一個網卡出現故障就會發生主備切換# eth0eth1}lvs_sync_daemon_inteface eth0   #設定lvs監聽網卡virtual_router_id 100           #設定虛擬路由ID號，同一組主備的ID號要一樣priority 100             #設定優先權，MASTER的優先順序要比BACKUP的高advert_int 1             #設定vrrp檢測時間，預設為1Sauthentication {         #設定認證資訊，主備要一樣auth_type PASSauth_pass 1111}virtual_ipaddress {10.204.172.2/26           #設定外網VIP}}vrrp_instance inside_network {state MASTERinterface eth1track_interface {eth0# eth1}lvs_sync_daemon_inteface eth0virtual_router_id 50priority 100advert_int 1authentication {auth_type PASSauth_pass 1111}virtual_ipaddress {192.168.1.21/24      #設定網關地址為內網VIP}}virtual_server 10.204.172.2 9912 {  #設定策略 vip+連接埠 delay_loop 6lb_algo rr   # 設定策略，在這裡為輪詢模式，也可以設定為wrr或其他lb_kind NAT  #設定為NAT模式，DR模式換為DR即可nat_mask 255.255.255.192#persistence_timeout 50 # 此處注釋，不然在50s裡面訪問的都是同一台後端伺服器protocol TCPreal_server 192.168.1.32 9912 {  #設定真實伺服器IP+連接埠weight 1TCP_CHECK {connect_timeout 3nb_get_retry 3delay_before_retry 3connect_port 9912  #設定串連連接埠}}real_server 192.168.1.31 9912 {weight 1TCP_CHECK {connect_timeout 3nb_get_retry 3delay_before_retry 3connect_port 9912}}}

 

 配置好了之後啟動keepalived服務

[[email protected] ~]# /etc/init.d/keepalived restart
Stopping keepalived: [  OK  ]
Starting keepalived: [  OK  ]

查看主lvs的IP

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M00/37/C6/wKiom1Ovo7Gh2pu2AASPNwZoLHI220.jpg" title="QQ2.png" alt="wKiom1Ovo7Gh2pu2AASPNwZoLHI220.jpg" />

查看備用lvs的IP

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M01/37/C5/wKioL1OvoR7y9CZiAALClyYPsTg576.jpg" title="圖片2.png" alt="wKioL1OvoR7y9CZiAALClyYPsTg576.jpg" />

查看lvs負載：

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M01/37/C6/wKiom1OvpI2CSkVKAAED3VUQzjU484.jpg" title="QQ圖片201.jpg" alt="wKiom1OvpI2CSkVKAAED3VUQzjU484.jpg" />

查看日誌

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M00/37/C5/wKioL1OvpOaCMuXkAAPhBRioV04352.jpg" title="QQ2014062.png" alt="wKioL1OvpOaCMuXkAAPhBRioV04352.jpg" />

類比主裝置出現故障，ifdown eth0 或者將keepalived服務關閉

會發現VIP都會切換到備用負載上面去。

通過訪問都能正常轉寄：

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M00/37/C6/wKiom1OvpfGA_LL3AACsDuuJEyk417.jpg" title="QQ圖.jpg" alt="wKiom1OvpfGA_LL3AACsDuuJEyk417.jpg" />

 

本文出自 “窮途--初心” 部落格，請務必保留此出處http://aixocm.blog.51cto.com/4208464/1432064