NAT模型实现http和https两种负载均衡集群
环境说明:
环境 | IP | 主机名 |
---|---|---|
DR | 192.168.25.131 172.25.0.100 | node01-Linux.example.com |
RS1 | 192.168.25.132 | node02-Linux.example.com |
RS2 | 192.168.25.133 | node03-Linux.example.com |
Client | 172.25.0.200 | node04-Linux.example.com |
NAT模式的HTTP负载集群
#配置DRip地址
[root@node01-Linux ~]# ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:8d:04:cf brd ff:ff:ff:ff:ff:ff
inet 192.168.25.128/24 brd 192.168.25.255 scope global noprefixroute dynamic eth0
valid_lft 1616sec preferred_lft 1616sec
inet 192.168.25.131/24 brd 192.168.25.255 scope global secondary eth0
valid_lft forever preferred_lft forever
inet6 fe80::df5d:976d:133d:ec61/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:8d:04:d9 brd ff:ff:ff:ff:ff:ff
inet 172.25.0.100/24 brd 172.25.0.255 scope global noprefixroute eth1
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe8d:4d9/64 scope link
valid_lft forever preferred_lft forever
#配置RS网关指向DIP
[root@node02-linux network-scripts]# vi ifcfg-eth0
TYPE="Ethernet"
BOOTPROTO="static"
NAME="eth0"
UUID="fd876bb3-6b9b-4a47-abfa-c6c49e562b0e"
DEVICE="eth0"
ONBOOT="yes"
IPADDR=192.168.25.132
NETMASK=255.255.255.0
GATEWAY=192.168.25.131
DNS1=114.114.114.114
[root@node02-linux ~]# systemctl restart network
[root@node03-Linux network-scripts]# vi ifcfg-eth0
TYPE="Ethernet"
BOOTPROTO="static"
NAME="eth0"
UUID="a8c74df3-b297-4705-b641-836a42a0613e"
DEVICE="eth0"
ONBOOT="yes"
IPADDR=192.168.25.133
NETMASK=255.255.255.0
GATEWAY=192.168.25.131
DNS1=114.114.114.114
[root@node03-Linux ~]# systemctl restart network
#开启ip转发功能
[root@node01-Linux ~]# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
[root@node01-Linux ~]# sysctl -p
net.ipv4.ip_forward = 1
#添加并保存规则
[root@node01-Linux ~]# ipvsadm -A -t 172.25.0.100:80 -s rr
[root@node01-Linux ~]# ipvsadm -a -t 172.25.0.100:80 -r 192.168.25.132:80 -m
[root@node01-Linux ~]# ipvsadm -a -t 172.25.0.100:80 -r 192.168.25.133:80 -m
[root@node01-Linux ~]# ipvsadm -S > /etc/sysconfig/ipvsadm
#查看规则
[root@node01-Linux ~]# ipvsadm -ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.0.100:80 rr
-> 192.168.25.132:80 Masq 1 0 0
-> 192.168.25.133:80 Masq 1 0 0
#在RS上部署HTTP
[root@node02-linux ~]# yum -y install httpd
[root@node02-linux ~]# echo 'RS1' > /var/www/html/index.html
[root@node02-linux ~]# systemctl enable --now httpd
[root@node03-Linux ~]# yum -y install httpd
[root@node03-Linux ~]# echo 'RS2' > /var/www/html/index.html
[root@node03-Linux ~]# systemctl enable --now httpd
#客户端访问验证
[root@node04-Linux ~]# for i in $(seq 8);do curl 172.25.0.100;done
RS2
RS1
RS2
RS1
RS2
RS1
RS2
RS1
NAT模式的HTTPS负载集群
#生成一对密钥
[root@node01-Linux ~]# cd /etc/pki/CA/
[root@node01-Linux CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@node01-Linux CA]# openssl rsa -in private/cakey.pem -pubout
#生成自签署证书
[root@node01-Linux CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 1024
[root@node01-Linux CA]# touch index.txt && echo 01 > serial
#发送给CA
[root@node02-Linux ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
#RS-1(httpd服务器)生成证书签署请求
[root@node02-Linux ssl]# openssl req -new -key httpd.key -days 1024 -out httpd.csr
[root@node02-Linux ssl]# ls
httpd.csr httpd.key
#把证书签署请求文件发送给CA
[root@node02-Linux ssl]# scp httpd.csr root@192.168.25.131:/root
#CA签署证书并发给客户端
[root@node01-Linux ~]# ls
anaconda-ks.cfg httpd.csr
[root@node01-Linux ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 1024
[root@node01-Linux ~]# ls
anaconda-ks.cfg httpd.crt httpd.csr
#CA把签署好的证书httpd.crt和服务端的证书cacert.pem发给客户端
[root@node01-Linux ~]# scp httpd.crt root@192.168.25.132:/etc/httpd/ssl
[root@node01-Linux ~]# scp cacert.pem root@192.168.25.132:/etc/httpd/ssl
#配置https
[root@node03-Linux ~]# yum -y install mod_ssl
[root@node03-Linux ~]# mkdir /etc/httpd/ssl
[root@node03-Linux ~]# yum -y install mod_ssl
[root@node03-Linux ssl]# scp cacert.pem httpd.crt httpd.key root@192.168.25.133:/etc/httpd/ssl
root@192.168.25.133's password:
cacert.pem 100% 1294 1.4MB/s 00:00
httpd.crt 100% 4416 5.4MB/s 00:00
httpd.key
#RS-2上查看
[root@node03-Linux ~]# ls /etc/httpd/ssl/
cacert.pem httpd.crt httpd.key
#修改https配置文件
[root@node02-Linux ~]# vim /etc/httpd/conf.d/ssl.conf
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
SSLCACertificateFile /etc/httpd/ssl/cacert.pem
#重启服务
[root@node02-Linux ~]# systemctl restart httpd
[root@node02-Linux ~]# ss -tanl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 [::1]:25 [::]:*
LISTEN 0 128 [::]:443 [::]:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
RS2上也要做如上配置
#LVS上配置规则
[root@node01-Linux ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.0.100:80 rr
-> 192.168.25.132:80 Masq 1 0 0
-> 192.168.25.133:80 Masq 1 0 0
[root@node01-Linux ~]# ipvsadm -A -t 172.25.0.100:443 -s rr
[root@node01-Linux ~]# ipvsadm -a -t 172.25.0.100:443 -r 192.168.25.132 -m
[root@node01-Linux ~]# ipvsadm -a -t 172.25.0.100:443 -r 192.168.25.133 -m
[root@node01-Linux ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.0.100:80 rr
-> 192.168.25.132:80 Masq 1 0 0
-> 192.168.25.133:80 Masq 1 0 0
TCP 172.25.0.100:443 rr
-> 192.168.25.132:443 Masq 1 0 0
-> 192.168.25.133:443 Masq 1 0 0
#访问
[root@node04-Linux ~]# for i in $(seq 8);do curl http://172.25.0.100;done
RS2
RS1
RS2
RS1
RS2
RS1
RS2
RS1
[root@node04-Linux ~]# for i in $(seq 8);do curl -k https://172.25.0.100;done
RS2
RS1
RS2
RS1
RS2
RS1
RS2
RS1