iptables+keepalived實現多源地址訪問

標籤：keepalived iptables

   

     情境介紹：

            用戶端商務服務器A：192.168.11.11

            iptables伺服器B： 192.168.22.22(主)    192.168.22.23(備)

                                VIP： 192.168.22.41 192.168.22.42

            服務端商務服務器C：192.168.33.33

      商務服務器C要進行IP源地址健全，每個客戶號要有獨立訪問的源地址。

      而所有的客戶號（例：1-10）都是指定在用戶端A的程式中，

      正常情況下，在伺服器C上看到的客戶號1-10所對應的都是同一個源地址，如何來解決這個問題呢？

      在A和C之間加個正向 Proxy伺服器即可，配置有多個地址，並在A程式雷根據客戶號訪問不同的Proxy 伺服器IP即可。

    

     本文中使用iptables裡的SNAT和DNAT功能來實現，並使用keepalived來進行二台熱備。

一、keepalived的配置如下：

! Configuration File for keepalived

global_defs {
   notification_email {
     [email protected]
   }
   notification_email_from [email protected]
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id iptables33
}

vrrp_instance MOPIN {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 110
    advert_int 1
    track_interface {
        eth0 weight 5
    }
    authentication {
        auth_type PASS
        auth_pass mopin
    }
    virtual_ipaddress {
        192.168.22.41/24 brd 192.168.22.255 dev eth0 label eth0:1
        192.168.22.42/24 brd 192.168.22.255 dev eth0 label eth0:2
      
    }
  notify_backup "/usr/local/keepalived/bin/show.sh vip1 backup"
  notify_master "/usr/local/keepalived/bin/show.sh vip1 master"
  notify_fault "/usr/local/keepalived/bin/show.sh vip1 fault"
  smtp_alert
}

二、iptables配置：

#Generated by iptables-save v1.4.7 on Fri Mar  4 16:03:45 2016
*mangle
:PREROUTING ACCEPT [881:72068]
:INPUT ACCEPT [881:72068]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1009:123804]
:POSTROUTING ACCEPT [1009:123804]
-A PREROUTING -d 192.168.22.41/32 -m conntrack --ctstate NEW -j MARK --set-xmark 0x41/0xffffffff
-A PREROUTING -d 192.168.22.42/32 -m conntrack --ctstate NEW -j MARK --set-xmark 0x42/0xffffffff

COMMIT
# Completed on Fri Mar  4 16:03:45 2016
# Generated by iptables-save v1.4.7 on Fri Mar  4 16:03:45 2016
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d 192.168.22.41/32 -p tcp -m tcp --dport 10041 -j DNAT --to-destination 192.168.33.33:80
-A PREROUTING -d 192.168.22.42/32 -p tcp -m tcp --dport 10042 -j DNAT --to-destination 192.168.33.33:80

-A POSTROUTING -m mark --mark 0x41 -j SNAT --to-source 192.168.22.41
-A POSTROUTING -m mark --mark 0x42 -j SNAT --to-source 192.168.22.42

COMMIT
# Completed on Fri Mar  4 16:03:45 2016
# Generated by iptables-save v1.4.7 on Fri Mar  4 16:03:45 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2024:234224]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p vrrp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -j ACCEPT
-A INPUT -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.0.0/16 -j ACCEPT
-A FORWARD -s 10.0.0.0/8 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Mar  4 16:03:45 2016

主要是針對不同的VIP地址進行mangle上打標籤，來區別不同的源地址。

本文出自 “秋天的童話” 部落格，請務必保留此出處http://wushank.blog.51cto.com/3489095/1747631

iptables+keepalived實現多源地址訪問