wKioL1YadfXR8WPpAALx_mdwEAA338.jpg



<<<<<<<<<<<<<<<<<<<Windows>>>>>>>>>>>>>>>>>>>>>>>>>
命令行提示符下：
route -p add 1.2.3.0/24 172.16.249.107
(route delete 1.2.3.0/24)

<<<<<<<<<<<<<<<<<<<Router>>>>>>>>>>>>>>>>>>>>>>>>>>>
网卡1：brige（自动获取）
网卡2：VMnet2
setup (设置网卡2)
eth1
eth1
192.168.20.1
255.255.255.0

eth1:0
eth1:0
1.2.3.5
255.255.255.0

service network restart
ifconfig
vim /etc/sysctl.conf
net.ipv4.ip_forward = 1

sysctl -p
ping 172.16.249.109 -I 192.168.20.1（必须的）
ping 172.16.249.109 -I 1.2.3.5 （必须的）
#ping 172.16.249.109 -I eth1 ——不行

<<<<<<<<<<<<<<<<<<<Real Server>>>>>>>>>>>>>>>>>>>>>>>>
网卡：VMnet2
setup
eth0
eth0
192.168.20.3(4)
255.255.255.0
192.168.20.1

service network restart
ifconfig
ping 172.16.249.109 （必须滴）
vim /etc/sysctl.conf
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2

sysctl -p
ifconfig lo:0 1.2.3.4/24 broadcast 1.2.3.4 up  (重启网络、系统将失效)
route add -host 1.2.3.4 dev lo:0   (重启网络、系统将失效)
echo "web server 1(2)" > /var/www/html/index.html
service httpd start
#curl http://192.168.20.3
#curl http://192.168.20.4

<<<<<<<<<<<<<<<<<<<Director>>>>>>>>>>>>>>>>>>>>>>>>
网卡：VMnet2
setup
192.168.20.2
255.255.255.0
192.168.20,1

service network restart
service iptables stop
ifconfig
ping 192.168.20.1
ping 192.168.20.3
ping 192.168.20.4
curl http://192.168.20.3
curl http://192.168.20.4
ifconfig eth0:0 1.2.3.4/24 broadcast 1.2.3.4 up (重启网络、系统丢失)
route add -host 1.2.3.4 dev eth0:0 (重启网络、系统丢失)
route -n
ping 172.16.249.109 -I 192.168.20.2 （不可缺少）
ping 172.16.249.109 -I 1.2.3.4 （不可缺少）
yum -y install ipvsadm
vim lvs-dr.sh
#!/bin/bash
#
ipvsadm -C
ipvsadm -A -t 1.2.3.4:80 -s rr
ipvsadm -a -t 1.2.3.4:80 -r 192.168.20.3 -g
ipvsadm -a -t 1.2.3.4:80 -r 192.168.20.4 -g
ipvsadm -L -n

bash lvs-dr.sh


================================ https ===================================
================================ https ===================================

<<<<<<<<<<<<<<<<<<<<< CA (Director) >>>>>>>>>>>>>>>>>>>>>>>>
date
cd /etc/pki/CA
(umask 077;openssl genrsa -out private/cakey.pem 2048)
openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 10000
CN
GuangDong
ShenZhen
changlinux
ca
ca.changlinux.com
cadmin@changlinux.com


<<<<<<<<<<<<<<<<<<<<Real Server1>>>>>>>>>>>>>>>>>>>>>>>>>>
date
cd /etc/httpd
mkdir ssl
cd ssl
(umask 077;openssl genrsa -out httpd.key 2048)
openssl req -new -key httpd.key -out httpd.csr -days 365
CN
GuangDong
ShenZhen
changlinux
web
www.changlinux.com
webadmin@changlinux.com

scp httpd.csr root@192.168.20.2:/root

<<<CA>>>
openssl ca -in /root/httpd.csr -out certs/www.changlinux.com.crt -days 365
scp certs/www.changlinux.com.crt root@192.168.20.3:/etc/httpd/ssl/

<<<Real Server1>>>
httpd -M | grep ssl
yum -y install mod_ssl
vim /etc/httpd/conf.d/ssl.conf
<VirtualHost *:443>
ServerName www.changlinux.com
SSLCertificateFile /etc/httpd/ssl/www.changlinux.com.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

service httpd restart







<<<<<<<<<<<<<<<<<<<<Real Server2>>>>>>>>>>>>>>>>>>>>>>>>>>
date
cd /etc/httpd
mkdir ssl
cd ssl
(umask 077;openssl genrsa -out httpd.key 2048)
openssl req -new -key httpd.key -out httpd.csr -days 365
CN
GuangDong
ShenZhen
changlinux
web
www.changlinux.com
webadmin@changlinux.com

scp httpd.csr root@192.168.20.2:/root

<<<CA>>>
openssl ca -in /root/httpd.csr -out certs/www.changlinux.com.crt -days 365
scp certs/www.changlinux.com.crt root@192.168.20.4:/etc/httpd/ssl/

<<<Real Server2>>>
httpd -M | grep ssl
yum -y install mod_ssl
vim /etc/httpd/conf.d/ssl.conf
<VirtualHost *:443>
ServerName www.changlinux.com
SSLCertificateFile /etc/httpd/ssl/www.changlinux.com.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

service httpd restart





<<<<<<<<<<<<<<<<<<<Director>>>>>>>>>>>>>>>>>>>>>>>>
vim lvs-dr-ssl.sh
#!/bin/bash
#
ipvsadm -C
ipvsadm -A -t 1.2.3.4:443 -s rr
ipvsadm -a -t 1.2.3.4:443 -r 192.168.20.3:443 -m
ipvsadm -a -t 1.2.3.4:443 -r 192.168.20.4:443 -m
ipvsadm -L -n

bash lvs-dr-ssl.sh


<<<<<<<<<<<<<<<<<<<<<<<<<<<windows>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
1、浏览器导入CA证书
2、修改hosts文件
3、https://www.changlinux.com访问