LVS配置

配置要求

分别实现NAT和DR模式下http和https负载均衡

NAT模式

环境说明

主机	IP地址	用途
DR	192.168.209.129	调度器
RS1	192.168.209.132	服务器1
RS2	192.168.209.133	服务器2

其中，DR调度器需要两块网卡

实现http负载均衡

(NAT模式调度器上要保证有两个不同类型的网卡，且RS的网关要指向LVS的DIP）

配置调度器DR

[root@DR ~]# yum -y install ipvsadm
[root@DR ~]# systemctl disable firewalld.service --now
[root@DR ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@DR ~]# setenforce 0

//配置DR的vip
[root@DR ~]# cd /etc/sysconfig/network-scripts/
[root@DR network-scripts]# cp ifcfg-ens32 ifcfg-ens34
[root@DR network-scripts]# vim ifcfg-ens34

TYPE=Ethernet
BOOTPROTO=static
NAME=ens34
DEVICE=ens34
ONBOOT=yes
IPADDR=192.168.11.250
PREFIX=24

[root@DR network-scripts]# systemctl restart NetworkManager
[root@DR network-scripts]# ifdown ens34;ifup ens34
[root@DR network-scripts]# ip a
……
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:09:5f:4b brd ff:ff:ff:ff:ff:ff
    inet 192.168.11.250/24 brd 192.168.11.255 scope global noprefixroute ens34
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe09:5f4b/64 scope link 
       valid_lft forever preferred_lft forever

//开启IP转发功能
[root@DR ~]# vim /etc/sysctl.conf
在最下方添加如下内容
net.ipv4.ip_forward = 1

[root@DR ~]# sysctl -p
net.ipv4.ip_forward = 1

配置RS服务器

//配置RS1
[root@RS1 ~]# systemctl disable firewalld.service --now
[root@RS1 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS1 ~]# setenforce 0
[root@RS1 ~]# yum -y install httpd net-tools
[root@RS1 ~]# systemctl enable httpd --now
[root@RS1 ~]# echo LVS-web1 > /var/www/html/index.html
#将网关指向DR的DIP
[root@RS1 ~]# route add default gw 192.168.209.129

//配置RS2
[root@RS2 ~]# systemctl disable firewalld.service --now
[root@RS2 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS2 ~]# setenforce 0
[root@RS2 ~]# yum -y install httpd net-tools
[root@RS2 ~]# systemctl enable httpd --now
[root@RS2 ~]# echo LVS-web1 > /var/www/html/index.html
#将网关指向DR的DIP
[root@RS2 ~]# route add default gw 192.168.209.129

//在调度器上添加并保存规则
[root@DR ~]# ipvsadm -A -t 192.168.11.250:80 -s rr
[root@DR ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.11.250:80 rr
[root@DR ~]# ipvsadm -a -t 192.168.11.250:80 -r 192.168.209.132 -m
[root@DR ~]# ipvsadm -a -t 192.168.11.250:80 -r 192.168.209.133 -m
[root@DR ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@DR ~]# systemctl enable ipvsadm
[root@DR ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.11.250:80 rr
  -> 192.168.209.132:80           Masq    1      0          0         
  -> 192.168.209.133:80           Masq    1      0          0

测试

[root@DR ~]# curl http://192.168.11.250
LVS-web2
[root@DR ~]# curl http://192.168.11.250
LVS-web1
[root@DR ~]# curl http://192.168.11.250
LVS-web2
[root@DR ~]# curl http://192.168.11.250
LVS-web1

实现https负载均衡

根据以上配置搭建https

搭建CA服务器端

//生成密钥
[root@DR ~]# mkdir -p /etc/pki/CA/private
[root@DR ~]# yum -y install expect
[root@DR ~]# cd /etc/pki/CA/
[root@DR CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@DR CA]# openssl rsa -in private/cakey.pem -pubout

//生成自签署证书
[root@DR CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 1024

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:123
Common Name (eg, your name or your server's hostname) []:cst
Email Address []:22@1.com

//RS1生成证书签署请求，并发送给CA
[root@RS1 ~]# yum -y install mod_ssl
[root@RS1 ~]# mkdir /etc/httpd/ssl
[root@RS1 ~]# cd /etc/httpd/ssl
[root@RS1 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)

[root@RS1 ssl]# openssl req -new -key httpd.key -days 1024 -out httpd.csr

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:123
Common Name (eg, your name or your server's hostname) []:cst
Email Address []:22@1.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@RS1 ssl]# ls
httpd.csr  httpd.key

//把证书签署请求文件发送给CA
[root@RS1 ssl]# scp httpd.csr root@192.168.209.129:/root

//DR签署证书并发给客户端
[root@DR ~]# mkdir /etc/pki/CA/newcerts
[root@DR ~]# touch /etc/pki/CA/index.txt
[root@DR ~]# echo "01" > /etc/pki/CA/serial
[root@DR ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 1024

[root@DR ~]# ls
httpd.crt  httpd.csr

//调度器把签署好的证书httpd.crt和服务端的证书cacert.pem发给客户端
[root@DR ~]# scp httpd.crt root@192.168.209.132:/etc/httpd/ssl

[root@DR ~]# scp /etc/pki/CA/cacert.pem root@192.168.209.132:/etc/httpd/ssl

//配置https
[root@RS2 ~]# yum -y install mod_ssl
[root@RS2 ~]# mkdir /etc/httpd/ssl

[root@RS1 ssl]# scp cacert.pem httpd.crt httpd.key root@192.168.209.133:/etc/httpd/ssl

[root@RS2 ~]# ls /etc/httpd/ssl/
cacert.pem  httpd.crt  httpd.key

//修改RS1和RS2的https配置文件
[root@RS1 ~]# vim /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/httpd/ssl/httpd.crt

SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

SSLCACertificateFile /etc/httpd/ssl/cacert.pem

[root@RS1 ~]# systemctl restart httpd

[root@RS2 ~]# vim /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/httpd/ssl/httpd.crt

SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

SSLCACertificateFile /etc/httpd/ssl/cacert.pem

[root@RS2 ~]# systemctl restart httpd

//在DR上配置规则并保存
[root@DR ~]# ipvsadm -A -t 192.168.11.250:443 -s rr
[root@DR ~]# ipvsadm -a -t 192.168.11.250:443 -r 192.168.209.132 -m
[root@DR ~]# ipvsadm -a -t 192.168.11.250:443 -r 192.168.209.133 -m
[root@DR ~]# ipvsadm -S > /etc/sysconfig/ipvsadm

测试

[root@DR ~]# curl -k https://192.168.11.250
LVS-web1
[root@DR ~]# curl -k https://192.168.11.250
LVS-web2
[root@DR ~]# curl -k https://192.168.11.250
LVS-web1
[root@DR ~]# curl -k https://192.168.11.250
LVS-web2

DR模式

环境说明

主机	DIP	VIP	用途
cst	-	-	客户机
DR	192.168.209.129	192.168.209.250	调度器
RS1	192.168.209.132	192.168.209.250	服务器1
RS2	192.168.209.133	192.168.209.250	服务器2

注意：虚拟机环境已初始化

实现http负载均衡

准备工作

//DR
[root@DR ~]# systemctl disable firewalld.service --now
[root@DR ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@DR ~]# setenforce 0
[root@DR ~]# yum -y install ipvsadm
[root@DR ~]# ip addr add 192.168.209.250/32 dev ens32 
[root@DR ~]# ip a
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:09:5f:41 brd ff:ff:ff:ff:ff:ff
    inet 192.168.209.129/24 brd 192.168.209.255 scope global dynamic noprefixroute ens32
       valid_lft 1079sec preferred_lft 1079sec
    inet 192.168.209.250/32 scope global ens32
       valid_lft forever preferred_lft forever
    inet6 fe80::2ab7:2250:63cc:acea/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

//RS1
[root@RS1 ~]# systemctl disable firewalld.service --now
[root@RS1 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS1 ~]# setenforce 0
[root@RS1 ~]# yum -y install httpd net-tools
[root@RS1 ~]# systemctl enable httpd --now
[root@RS1 ~]# echo LVS-web1 > /var/www/html/index.html

//RS2
[root@RS2 ~]# systemctl disable firewalld.service --now
[root@RS2 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS2 ~]# setenforce 0
[root@RS2 ~]# yum -y install httpd net-tools
[root@RS2 ~]# systemctl enable httpd --now
[root@RS2 ~]# echo LVS-web2 > /var/www/html/index.html

RS服务器配置

//RS1
[root@RS1 ~]# vim /etc/sysctl.conf
#在最下方添加如下内容
net.ipv4.conf.all.arp_ignore = 1	# 将对应网卡设置为只回应目标IP为自身接口地址的ARP请求
net.ipv4.conf.all.arp_announce = 2	# 将ARP请求的源IP设置为eth0上的IP，也就是RIP

[root@RS1 ~]# sysctl -p
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2

//RS2
[root@RS2 ~]# vim /etc/sysctl.conf
#在最下方添加如下内容
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2

[root@RS2 ~]# sysctl -p
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2

配置VIP

//RS1
[root@RS1 ~]# ip addr add 192.168.209.250/32 dev lo
[root@RS1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 192.168.209.250/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

//RS2
[root@RS2 ~]# ip addr add 192.168.209.250/32 dev lo
[root@RS2 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 192.168.209.250/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

配置路由信息

//RS1
[root@RS1 ~]# route add -host 192.168.209.250/32 dev lo
#永久配置
[root@RS1 ~]# echo '192.168.209.250/32 via 0.0.0.0 dev lo' > /etc/sysconfig/network-scripts/route-lo
[root@RS1 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.209.2   0.0.0.0         UG    100    0        0 ens32
192.168.209.0   0.0.0.0         255.255.255.0   U     100    0        0 ens32
192.168.209.250 0.0.0.0         255.255.255.255 UH    0      0        0 lo

//RS2
[root@RS2 ~]# route add -host 192.168.209.250/32 dev lo
#永久配置
[root@RS2 ~]# echo '192.168.209.250/32 via 0.0.0.0 dev lo' > /etc/sysconfig/network-scripts/route-lo
[root@RS2 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.209.2   0.0.0.0         UG    100    0        0 ens32
192.168.209.0   0.0.0.0         255.255.255.0   U     100    0        0 ens32
192.168.209.250 0.0.0.0         255.255.255.255 UH    0      0        0 lo

添加并保存规则

[root@DR ~]# ipvsadm -A -t 192.168.209.250:80 -s wrr
[root@DR ~]# ipvsadm -a -t 192.168.209.250:80 -r 192.168.209.132 -g
[root@DR ~]# ipvsadm -a -t 192.168.209.250:80 -r 192.168.209.133 -g
[root@DR ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@DR ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.209.250:80 wrr
  -> 192.168.209.132:80           Route   1      0          0         
  -> 192.168.209.133:80           Route   1      0          0

[root@DR ~]# systemctl enable ipvsadm.service --now

测试

[root@cst ~]# curl 192.168.209.250
LVS-web1
[root@cst ~]# curl 192.168.209.250
LVS-web2
[root@cst ~]# curl 192.168.209.250
LVS-web1
[root@cst ~]# curl 192.168.209.250
LVS-web2

posted @ 2021-05-06 20:26 绫璟阅读(205) 评论(0) 收藏举报

刷新页面返回顶部

绫璟

LVS配置

配置要求

NAT模式

实现http负载均衡

配置调度器DR

配置RS服务器

测试

实现https负载均衡

搭建CA服务器端

测试

DR模式

实现http负载均衡

准备工作

RS服务器配置

配置VIP

配置路由信息

添加并保存规则

测试

公告