LVS-学习总结( VS/TUN实践)

最新推荐文章于 2021-06-16 15:33:23 发布

csdnlb

最新推荐文章于 2021-06-16 15:33:23 发布

阅读量311

点赞数

分类专栏： Linux运维-企业实战

本文链接：https://blog.csdn.net/csdnlb/article/details/104204846

版权

Linux运维-企业实战专栏收录该内容

35 篇文章 10 订阅

订阅专栏

文章目录

实践环境
操作步骤
测试结果

实践环境

主机名	系统	IP地址	作用
vmhost	rhel7.5	192.168.12.7/24	真机，提供虚拟机node1-3进行实践练习环境，同时进行测试添加192.168.12.1(临时地址，作为通信网关使用)
node1	rhel7.5	192.168.12.11/24 192.168.27.11/24	虚拟机node1，安装ipvadm软件，模拟LVS调度服务器同时node1是双网卡:一个IP地址（外网地址）用来模拟VIP与真机在同一网段，方便测试；一个IP地址（内网地址）是与后端服务器在同一网段进行通信的
node2	rhel7.5	192.168.27.12/24	虚拟机node2，安装httpd服务，模拟后端服务器
node3	rhel7.5	192.168.27.13/24	虚拟机ndoe3，安装httpd服务，模拟后端服务器

测试将192.168.12.X看为外网地址，192.168.27.X看为内网地址

操作步骤

与之前VS/DR实践中一样，检测node1服务器内核是否有IPVS功能
与之前VS/DR实践中一样，node1服务器安装ipvsadm软件
node1服务器配置VS/DR策略

#先清空ipvsadm配置，保持环境纯净
[root@node1 ~]# ipvsadm -C


#添加规则VS/TUN策略，调度策略为wrr，且服务器node2权重为2，node3权重为1
[root@node1 ~]# ipvsadm -A -t 192.168.12.11:80 -s wrr
[root@node1 ~]# ipvsadm -a -t 192.168.12.11:80 -r 192.168.27.12:80 -i -w 2
[root@node1 ~]# ipvsadm -a -t 192.168.12.11:80 -r 192.168.27.13:80 -i -w 1
    

#查看策略是否添加成功
[root@node1 ~]# ipvsadm -ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.12.11:80 wrr
  -> 192.168.27.12:80             Tunnel  2      0          0         
  -> 192.168.27.13:80             Tunnel  1      0          0

node1服务添加网关192.168.12.1
因为VS/TUN模型使用IP隧道通信，需要路过网关

[root@node1 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.12.1    0.0.0.0         UG    100    0        0 eth0
192.168.12.1    0.0.0.0         255.255.255.255 UH    100    0        0 eth0
192.168.27.0    0.0.0.0         255.255.255.0   U     100    0        0 eth0

node1服务添加IP隧道模块，添加VIP地址到tunl0网卡上

[root@node1 ~]# lsmod |grep ipip
#查看是否存在IP隧道模块
[root@node1 ~]# modprobe ipip
#添加IP隧道模块
[root@node1 ~]# lsmod |grep ipip
ipip                   13465  0 
tunnel4                13252  1 ipip
ip_tunnel              25163  1 ipip
#再次查看
[root@node1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:a4:30:62 brd ff:ff:ff:ff:ff:ff
    inet 192.168.27.11/24 brd 192.168.27.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:2f:0d:fc brd ff:ff:ff:ff:ff:ff
    inet 192.168.12.11/24 brd 192.168.12.255 scope global noprefixroute eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe2f:dfc/64 scope link 
       valid_lft forever preferred_lft forever
4: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
#添加IP隧道模块后会多一个tunl0的网卡，tunl0处于DOWN状态，未开启

[root@node1 ~]# ip addr del 192.168.12.11/32 dev eth1
#删除原网卡eth1中VIP地址
[root@node1 ~]# ip addr add 192.168.12.11/32 dev tunl0
#添加VIP地址到tunl0网卡上
[root@node1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:a4:30:62 brd ff:ff:ff:ff:ff:ff
    inet 192.168.27.11/24 brd 192.168.27.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:2f:0d:fc brd ff:ff:ff:ff:ff:ff
    inet6 fe80::5054:ff:fe2f:dfc/64 scope link 
       valid_lft forever preferred_lft forever
4: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
    inet 192.168.12.11/32 scope global tunl0
       valid_lft forever preferred_lft forever
[root@node1 ~]# ip link set up tunl0
#激活tunl0设备

与之前VS/DR实践中一样node2、node3服务器安装httpd
与之前VS/DR实践中一样node2和node3服务器的网关地址设置为192.168.12.1
VS/DR模型后端服务器需要直接通过网络通信测试客户端，所以此处建立通信网关
node2和node3服务器均需要安装IP隧道模块，并添加VIP地址到tunl0设备上
VS/TUN模型后端服务器需要直接通过网络通信测试客户端，所以需要添加VIP地址信息

[root@node2 ~]# lsmod |grep ipip
[root@node2 ~]# modprobe ipip
[root@node2 ~]# modprobe ipip
[root@node2 ~]# lsmod |grep ipip
ipip                   13465  0 
tunnel4                13252  1 ipip
ip_tunnel              25163  1 ipip
[root@node2 ~]# ip addr add 192.168.12.11/32 dev tunl0
[root@node2 ~]# ip link set up tunl0


[root@node3 ~]# lsmod |grep ipip
[root@node3 ~]# modprobe ipip
[root@node3 ~]# lsmod |grep ipip
ipip                   13465  0 
tunnel4                13252  1 ipip
ip_tunnel              25163  1 ipip
[root@node3 ~]# ip addr add 192.168.12.11/32 dev tunl0
[root@node3 ~]# ip link set up tunl0

node2与node3关闭内核rp_filter相关功能，关闭对数据包的校验
为了防止web服务器不认识发来的拆包后的源ip把数据包给丢掉，导致web服务器丢包，客户端访问不到数据，因为隧道模式实现的是不同网段的主机进行通信，如果信息要从服务端返回到客户端时，由于客户端和服务端不在同一个网段，数据根本出不去，所以我们需要关闭数据校验

[root@node2 ~]# sysctl -a|grep rp_filter
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 1
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.eth0.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
sysctl: reading key "net.ipv6.conf.tunl0.stable_secret"
#关闭所有显示=1的规则
[root@node2 ~]# sysctl -w t.ipv4.conf.all.rp_filter = 0
sysctl: "t.ipv4.conf.all.rp_filter" must be of the form name=value
sysctl: malformed setting "="
sysctl: "0" must be of the form name=value
[root@node2 ~]# sysctl -w net.ipv4.conf.all.rp_filter = 0
sysctl: "net.ipv4.conf.all.rp_filter" must be of the form name=value
sysctl: malformed setting "="
sysctl: "0" must be of the form name=value
[root@node2 ~]# sysctl -w net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.all.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.eth0.rp_filter=0
net.ipv4.conf.eth0.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.tunl0.rp_filter=0
net.ipv4.conf.tunl0.rp_filter = 0
[root@node2 ~]# sysctl -p
#是规则生效

#node3服务器操作一样

因为没有真实网关服务器，所以为满足测试，临时将192.168.12.1填在真机的网卡上，作为网关使用

[root@vmhost images]#ip addr add 192.168.12.1/32 dev br0

测试结果

使用真机的外网地址192.168.12.7，访问192.168.12.11VIP进行测试

[root@vmhost images]# curl 192.168.12.11
node3
[root@vmhost images]# curl 192.168.12.11
node2
[root@vmhost images]# curl 192.168.12.11
node2
[root@vmhost images]# curl 192.168.12.11
node3
[root@vmhost images]# curl 192.168.12.11
node2
[root@vmhost images]# curl 192.168.12.11
node2

#因为使用的是wrr调度方式，且node2服务器权重为2，node3服务器权重为1，所以测试结果node2显示2次node3显示1次,

[root@node2 ~]# sysctl -a|grep rp_filter
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 1
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.eth0.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
sysctl: reading key "net.ipv6.conf.tunl0.stable_secret"
[root@node2 ~]# sysctl -w t.ipv4.conf.all.rp_filter = 0
sysctl: "t.ipv4.conf.all.rp_filter" must be of the form name=value
sysctl: malformed setting "="
sysctl: "0" must be of the form name=value
[root@node2 ~]# sysctl -w net.ipv4.conf.all.rp_filter = 0
sysctl: "net.ipv4.conf.all.rp_filter" must be of the form name=value
sysctl: malformed setting "="
sysctl: "0" must be of the form name=value
[root@node2 ~]# sysctl -w net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.all.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.eth0.rp_filter=0
net.ipv4.conf.eth0.rp_filter = 0
[root@node2 ~]# sysctl -w net.ipv4.conf.tunl0.rp_filter=0
net.ipv4.conf.tunl0.rp_filter = 0