lvs负载均衡

2201_75894418

994人浏览 · 2025-09-22 19:12:22

2201_75894418 · 2025-09-22 19:12:22 发布

lvs负载均衡

一、配置lvs-nat模式的httpd负载集群—http

在这里插入图片描述

环境说明：

主机名称	网卡信息（ens33为nat、ens36为仅主机）	安装应用
Client客户端	172.16.30.20（ens33，仅主机）	无
DR	DIP:192.168.100.10(ens33)—VIP:172.16.30.10(ens36)	ipvsadm
RS1	RIP:192.168.100.20(ens33)—gw:192.168.100.10	httpd
RS2	RIP:192.168.100.30(ens33)—gw:192.168.100.10	httpd

1、DR、RS1、RS2三台主机都关闭防火墙和selinux

[root@rs1 ~]# systemctl stop firewalld.service 
[root@rs1 ~]# systemctl disable firewalld.service 
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@rs1 ~]# vim /etc/selinux/config 
[root@rs1 ~]# reboot
[root@rs1 ~]# getenforce 
Disabled

2、配置ip信息

（1）将RS1、RS2的网关都改为DR的DIP的IP地址—192.168.100.10

[root@rs1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
[root@rs1 ~]# systemctl restart network

[root@rs2 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
[root@rs2 ~]# systemctl restart network

在这里插入图片描述

（2）DR中添加一个网卡（仅主机模式—172.16.30.10）

在这里插入图片描述

[root@stw ~]# nmcli connection show
NAME                UUID                                  TYPE      DEVICE 
ens33               44f1b6ef-509f-42e1-88ab-ff974b9dc01b  ethernet  ens33  
virbr0              62979ab5-8b4b-4f62-93fe-3dd04528673b  bridge    virbr0 
Wired connection 1  55c217d0-aa81-38f0-9d73-855c788dc464  ethernet  ens36  
[root@stw ~]# nmcli connection delete Wired\ connection\ 1 
Connection 'Wired connection 1' (55c217d0-aa81-38f0-9d73-855c788dc464) successfully deleted.
[root@stw ~]# nmcli connection add con-name ens36 ifname ens36 type ethernet 
Connection 'ens36' (3362fc33-a397-4683-8083-5ee03888d178) successfully added.
[root@stw ~]# nmcli connection show
NAME    UUID                                  TYPE      DEVICE 
ens33   44f1b6ef-509f-42e1-88ab-ff974b9dc01b  ethernet  ens33  
virbr0  62979ab5-8b4b-4f62-93fe-3dd04528673b  bridge    virbr0 
ens36   3362fc33-a397-4683-8083-5ee03888d178  ethernet  ens36  
[root@stw ~]# nmcli connection modify ens36 ipv4.addresses 172.16.30.10/24 ipv4.method manual connection.autoconnect yes
[root@stw ~]# nmcli connection up ens36
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/9)
[root@stw ~]# ip a
......
......
5: ens36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:b9:a3:34 brd ff:ff:ff:ff:ff:ff
    inet 172.16.30.10/24 brd 172.16.30.255 scope global noprefixroute ens36
       valid_lft forever preferred_lft forever
    inet6 fe80::af9e:968f:6fda:a4f2/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

DR主机中开启IP转发

[root@stw ~]# vim /etc/sysctl.conf 
[root@stw ~]# sysctl -p
net.ipv4.ip_forward = 1

3、后端RS1和RS2部署WEB服务器

（1）RS1、RS2都安装yum仓库，安装httpd

[root@rs1 ~]# cd /etc/yum.repos.d/
[root@rs1 yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@rs1 yum.repos.d]# rm -rf *
[root@rs1 yum.repos.d]# vim server.repo
[root@rs1 yum.repos.d]# cat server.repo
[aa]
name=aa1
baseurl=file:///mnt
enabled=1
gpgcheck=0
[root@rs1 yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@rs1 yum.repos.d]# yum -y install httpd


[root@rs2 ~]# cd /etc/yum.repos.d/
[root@rs2 yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@rs2 yum.repos.d]# rm -rf *
[root@rs2 yum.repos.d]# vim server.repo
[root@rs2 yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@rs2 yum.repos.d]# yum -y install httpd

（2）分别对RS1、RS2写入网页

[root@rs1 ~]# echo RS1 > /var/www/html/index.html
[root@rs1 ~]# cat /var/www/html/index.html
RS1
[root@rs1 ~]# systemctl restart httpd
[root@rs1 ~]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.


[root@rs2 ~]# echo RS2 > /var/www/html/index.html
[root@rs2 ~]# cat /var/www/html/index.html
RS2
[root@rs2 ~]# systemctl restart httpd
[root@rs2 ~]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

（3）客户端测试WEB服务器是否部署成功

[root@stw4 ~]# curl http://192.168.100.20
RS1
[root@stw4 ~]# curl http://192.168.100.30
RS2

4、配置DR

（1）安装ipvsadm

[root@stw ~]# cd /etc/yum.repos.d/
[root@stw yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@stw yum.repos.d]# rm -rf *
[root@stw yum.repos.d]# vim server.repo
[root@stw yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@stw yum.repos.d]# yum -y install ipvsadm

（2）添加规则

[root@stw ~]# ipvsadm -A -t 172.16.30.10:80 -s rr
[root@stw ~]# ipvsadm -a -t 172.16.30.10:80 -r 192.168.100.20:80 -m
[root@stw ~]# ipvsadm -a -t 172.16.30.10:80 -r 192.168.100.30:80 -m
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.16.30.10:80 rr
  -> 192.168.100.20:80            Masq    1      0          0         
  -> 192.168.100.30:80            Masq    1      0          0         
[root@stw ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@stw ~]# systemctl restart ipvsadm.service 
[root@stw ~]# systemctl enable ipvsadm.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/ipvsadm.service to /usr/lib/systemd/system/ipvsadm.service.

5、客户端测试（客户端改为仅主机模式----172.16.30.20）

在这里插入图片描述

[root@stw4 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
[root@stw4 ~]# systemctl restart network

在这里插入图片描述

[root@stw4 ~]# curl http://172.16.30.10
RS2
[root@stw4 ~]# curl http://172.16.30.10
RS1
[root@stw4 ~]# curl http://172.16.30.10
RS2
[root@stw4 ~]# curl http://172.16.30.10
RS1

二、配置lvs-nat模式的httpd负载集群—https

1、配置https

（1）在DR中生成一对密钥（将DR当做CA）

[root@stw ~]# cd /etc/pki/CA
[root@stw CA]# ls
certs  crl  newcerts  private
[root@stw CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)  //私钥
Generating RSA private key, 2048 bit long modulus
..................................................+++
........+++
e is 65537 (0x10001)
[root@stw CA]# openssl rsa -in private/cakey.pem -pubout   //公钥
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwzOAAvIU4gI9AJ5Ht0Tc
AAyPL6coEYCnqRCFtKDmC2z9rwjhOQkH4bvEGsqYxbe6b2wsnwXYQZmTRXKMKqCL
gtX+mHz57mq2UlFeTKmGXe+QxfQCwBLMaBobYfmk5S6xOZvkAeQzA4FhXl5ejNrp
fKBqr68mTJa/KjIU/KAJqdndDnKHKzGmMX6gFvEd78TgDDwGdq6rHAZV0hv5dkEt
jPrCrqLdmHamYBbJZEObhjzlu6jSeIex1MbsolzyS6op/m7N+7QFTUWml30N/r4X
yvO+sITHwcIGRimZRy609680xB8rugSCWcunnV7cjr0+OLsSM8Y47olHEh87gx2J
gQIDAQAB
-----END PUBLIC KEY-----
[root@stw CA]# ls
certs  crl  newcerts  private
[root@stw CA]# cd private/
[root@stw private]# ls
cakey.pem
[root@stw ~]# cd /etc/pki/CA
[root@stw CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 1024
//基于私钥生成根证书
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:LQ
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:server.example.com
Email Address []:stw@example.com
[root@stw CA]# touch index.txt
[root@stw CA]# echo 01 > serial

（2）RS1、RS2中下载mod_ssl，并创建/etc/httpd/ssl目录

[root@rs1 ~]# yum -y install mod_ssl
[root@rs1 ~]# mkdir /etc/httpd/ssl

[root@rs2 ~]# yum -y install mod_ssl
[root@rs2 ~]# mkdir /etc/httpd/ssl

（3）在RS1中生成证书签署请求，并发送给CA

[root@rs1 ~]# cd /etc/httpd/ssl
[root@rs1 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)  //私钥
Generating RSA private key, 2048 bit long modulus
..........................................................+++
......+++
e is 65537 (0x10001)
[root@rs1 ssl]# openssl req -new -key httpd.key -days 1024 -out httpd.csr
//根据私钥生成自签名证书
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:LQ
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:rs.example.com
Email Address []:stw@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@rs1 ssl]# ls
httpd.csr  httpd.key
[root@rs1 ssl]# scp httpd.csr root@192.168.100.10:/root/
The authenticity of host '192.168.100.10 (192.168.100.10)' can't be established.
ECDSA key fingerprint is SHA256:R7/1dpul7cu8SnefsN2wQw5hKDL+xekk0ffasLS6OGI.
ECDSA key fingerprint is MD5:81:88:a1:16:52:83:c0:d5:59:ad:2b:3a:d5:52:02:bc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.100.10' (ECDSA) to the list of known hosts.
root@192.168.100.10's password: 
httpd.csr                                             100% 1033   892.5KB/s   00:00

在DR中查看

[root@stw ~]# ls
anaconda-ks.cfg  Documents  httpd.csr             Music     Public     Videos
Desktop          Downloads  initial-setup-ks.cfg  Pictures  Templates

（4）CA签署证书

[root@stw ~]# openssl ca -in httpd.csr -out httpd.crt -days 1024
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Sep 22 08:10:30 2025 GMT
            Not After : Jul 12 08:10:30 2028 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = LQ
            organizationalUnitName    = linux
            commonName                = rs.example.com
            emailAddress              = stw@example.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                2C:B4:AD:6A:3E:7C:46:19:85:53:27:71:25:36:A8:26:92:90:20:C0
            X509v3 Authority Key Identifier: 
                keyid:B0:A0:11:9F:F8:F0:61:D2:34:1E:FF:8B:74:D9:5D:2D:9D:14:39:E2

Certificate is to be certified until Jul 12 08:10:30 2028 GMT (1024 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@stw ~]# ls
anaconda-ks.cfg  Documents  httpd.crt  initial-setup-ks.cfg  Pictures  Templates
Desktop          Downloads  httpd.csr  Music                 Public    Videos

（5）将CA签署的证书httpd.crt和服务器的证书cacert.pem发送给RS1

[root@stw ~]# scp /etc/pki/CA/cacert.pem root@192.168.100.20:/etc/httpd/ssl
The authenticity of host '192.168.100.20 (192.168.100.20)' can't be established.
ECDSA key fingerprint is SHA256:R7/1dpul7cu8SnefsN2wQw5hKDL+xekk0ffasLS6OGI.
ECDSA key fingerprint is MD5:81:88:a1:16:52:83:c0:d5:59:ad:2b:3a:d5:52:02:bc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.100.20' (ECDSA) to the list of known hosts.
root@192.168.100.20's password: 
cacert.pem                                            100% 1391   612.0KB/s   00:00    
[root@stw ~]# scp httpd.crt root@192.168.100.20:/etc/httpd/ssl
root@192.168.100.20's password: 
httpd.crt                                             100% 4571     1.5MB/s   00:00

（6）RS1中把RS1的证书和密钥发送给RS2

[root@rs1 ssl]# scp cacert.pem httpd.crt httpd.key root@192.168.100.30:/etc/httpd/ssl
The authenticity of host '192.168.100.30 (192.168.100.30)' can't be established.
ECDSA key fingerprint is SHA256:R7/1dpul7cu8SnefsN2wQw5hKDL+xekk0ffasLS6OGI.
ECDSA key fingerprint is MD5:81:88:a1:16:52:83:c0:d5:59:ad:2b:3a:d5:52:02:bc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.100.30' (ECDSA) to the list of known hosts.
root@192.168.100.30's password: 
cacert.pem                                            100% 1391   849.0KB/s   00:00    
httpd.crt                                             100% 4571     3.1MB/s   00:00    
httpd.key                                             100% 1675   775.5KB/s   00:00

RS2中查看

[root@rs2 ssl]# ls
cacert.pem  httpd.crt  httpd.key

（7）RS1、RS2中修改https的配置文件（更改完RS1中的配置文件之后直接scp到RS2中）

[root@rs1 ssl]# vim /etc/httpd/conf.d/ssl.conf 
[root@rs1 ssl]# scp /etc/httpd/conf.d/ssl.conf root@192.168.100.30:/etc/httpd/conf.d/ssl.conf
root@192.168.100.30's password: 
ssl.conf                                              100% 9472     1.2MB/s   00:00

在这里插入图片描述

（8）起服务（查看端口443）

[root@rs1 ssl]# systemctl restart httpd

[root@rs2 ssl]# systemctl restart httpd
[root@rs1 ssl]# ss -anlt
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN     0      128              *:111                          *:*                  
LISTEN     0      128              *:6000                         *:*                  
LISTEN     0      5      192.168.122.1:53                           *:*                  
LISTEN     0      128              *:22                           *:*                  
LISTEN     0      128      127.0.0.1:631                          *:*                  
LISTEN     0      100      127.0.0.1:25                           *:*                  
LISTEN     0      128      127.0.0.1:6010                         *:*                  
LISTEN     0      128             :::111                         :::*                  
LISTEN     0      128             :::80                          :::*                  
LISTEN     0      128             :::6000                        :::*                  
LISTEN     0      128             :::22                          :::*                  
LISTEN     0      128            ::1:631                         :::*                  
LISTEN     0      100            ::1:25                          :::*                  
LISTEN     0      128            ::1:6010                        :::*                  
LISTEN     0      128             :::443                         :::*

2、在DR中添加规则

[root@stw ~]# ipvsadm -A -t 172.16.30.10:443 -s rr
[root@stw ~]# ipvsadm -a -t 172.16.30.10:443 -r 192.168.100.20 -m
[root@stw ~]# ipvsadm -a -t 172.16.30.10:443 -r 192.168.100.30 -m
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.16.30.10:80 rr
  -> 192.168.100.20:80            Masq    1      0          0         
  -> 192.168.100.30:80            Masq    1      0          0         
TCP  172.16.30.10:443 rr
  -> 192.168.100.20:443           Masq    1      0          0         
  -> 192.168.100.30:443           Masq    1      0          0         
[root@stw ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@stw ~]# systemctl restart ipvsadm

3、客户端测试

[root@stw4 ~]# curl -k https://172.16.30.10:443
RS2
[root@stw4 ~]# curl -k https://172.16.30.10:443
RS1
[root@stw4 ~]# curl -k https://172.16.30.10:443
RS2
[root@stw4 ~]# curl -k https://172.16.30.10:443
RS1
[root@stw4 ~]# curl http://172.16.30.10
RS2
[root@stw4 ~]# curl http://172.16.30.10
RS1
[root@stw4 ~]# curl http://172.16.30.10
RS2
[root@stw4 ~]# curl http://172.16.30.10
RS1

三、配置lvs-dr模式的httpd负载集群

主机角色	DIP（调度器内网IP）	RIP（真实服务器IP）	VIP（虚拟IP）	客户端IP
Lvs服务器（DR）	192.168.100.10	-	192.168.100.100/32	-
Apache服务器（RS1）	-	192.168.100.20	192.168.100.100/32	-
Apache服务器（RS2）	-	192.168.100.30	192.168.100.100/32	-
client客户端	-	-	-	192.168.100.40

1、关闭防火墙selinux（DR、RS1、RS2）

以DR为例，其余略

[root@stw ~]# systemctl stop firewalld.service 
[root@stw ~]# systemctl disable firewalld.service 
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@stw ~]# vim /etc/selinux/config 
[root@stw ~]# reboot
[root@stw ~]# getenforce 
Disabled

2、RS1、RS2配置yum仓库安装httpd

以RS1为例：

[root@stw2 ~]# cd /etc/yum.repos.d/
[root@stw2 yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@stw2 yum.repos.d]# rm -rf *
[root@stw2 yum.repos.d]# vim server.repo
[root@stw2 yum.repos.d]# cat server.repo
[aa]
name=aa1
baseurl=file:///mnt
enabled=1
gpgcheck=0
[root@stw2 yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@stw2 yum.repos.d]# yum -y install httpd
[root@stw2 yum.repos.d]# echo "RS1" > /var/www/html/index.html
[root@stw2 yum.repos.d]# cat /var/www/html/index.html
RS1
[root@stw2 yum.repos.d]# systemctl restart httpd
[root@stw2 yum.repos.d]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

3、配置DR

（1）开启IP转发

[root@stw ~]# vim /etc/sysctl.conf 
[root@stw ~]# sysctl -p
net.ipv4.ip_forward = 1

（2）添加IP（配置环回口IP地址）

[root@stw ~]# ifconfig lo 192.168.100.100/32 broadcast 192.168.100.100 netmask 255.255.255.255 up
[root@stw ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 192.168.100.100/0 brd 192.168.100.100 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:b9:a3:2a brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.10/24 brd 192.168.100.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::3233:2f91:158e:95c2/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff

4、RS上配置arp内核参数----避免请求时产生冲突

RS1和RS2上都需要操作

#将对应网卡设置为只回应目标IP为自身接口地址的ARP请求

net.ipv4.conf.all.arp_ignore = 1

#将ARP请求的源IP设置为所有接口的IP，也就是RIP

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.lo.arp_ignore = 1

net.ipv4.conf.lo.arp_announce = 2

[root@stw2 ~]# vim /etc/sysctl.conf 
[root@stw2 ~]# sysctl -p
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2

[root@stw3 ~]# vim /etc/sysctl.conf 
[root@stw3 ~]# sysctl -p
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2

5、RS上配置VIP

一定要先配置好内核参数，再配置VIP，如果先配置VIP，VIP配置好后会立即通告给所有人，而修改内核参数就是为了不通告

LVS服务器的lo网卡的ip：192.168.100.100 作为VIP ,两台RS都要做

[root@stw2 ~]# ifconfig lo 192.168.100.100/32 broadcast 192.168.100.100 netmask 255.255.255.255 up

[root@stw3 ~]# ifconfig lo 192.168.100.100/32 broadcast 192.168.100.100 netmask 255.255.255.255 up
[root@stw3 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 192.168.100.100/0 brd 192.168.100.100 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:d3:d8:82 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.30/24 brd 192.168.100.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::9510:d8d7:5d52:d7b3/64 scope link tentative noprefixroute dadfailed 
       valid_lft forever preferred_lft forever
    inet6 fe80::2850:4f7d:bcdd:ccb3/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff

6、添加路由信息（静态路由）

RS1:

[root@stw2 ~]# route add -host 192.168.100.100/32 dev lo
[root@stw2 ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway         0.0.0.0         UG    100    0        0 ens33
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 ens33
stw2.example.co 0.0.0.0         255.255.255.255 UH    0      0        0 lo
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

RS2:

[root@stw3 ~]# route add -host 192.168.100.100/32 dev lo
[root@stw3 ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway         0.0.0.0         UG    100    0        0 ens33
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 ens33
stw3.example.co 0.0.0.0         255.255.255.255 UH    0      0        0 lo
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

7、安装ipvsadm

[root@stw ~]# cd /etc/yum.repos.d/
[root@stw yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@stw yum.repos.d]# rm -rf *
[root@stw yum.repos.d]# vim server.repo
[root@stw yum.repos.d]# cat server.repo
[aa]
name=aa1
baseurl=file:///mnt
enabled=1
gpgcheck=0
[root@stw yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@stw yum.repos.d]# yum -y install ipvsadm

8、添加并保存规则

[root@stw ~]# ipvsadm -A -t 192.168.100.100:80 -s rr
[root@stw ~]# ipvsadm -a -t 192.168.100.100:80 -r 192.168.100.20 -g
[root@stw ~]# ipvsadm -a -t 192.168.100.100:80 -r 192.168.100.30 -g
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.100.100:80 rr
  -> 192.168.100.20:80            Route   1      0          0         
  -> 192.168.100.30:80            Route   1      0          0         
[root@stw ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@stw ~]# systemctl restart ipvsadm
[root@stw ~]# systemctl enable ipvsadm
Created symlink from /etc/systemd/system/multi-user.target.wants/ipvsadm.service to /usr/lib/systemd/system/ipvsadm.service.

9、客户端测试

[root@stw4 ~]# curl http://192.168.100.100
RS2
[root@stw4 ~]# curl http://192.168.100.100
RS1
[root@stw4 ~]# curl http://192.168.100.100
RS2
[root@stw4 ~]# curl http://192.168.100.100
RS1

扩展：添加权重

（1）先清空添加的规则

[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.100.100:80 rr
  -> 192.168.100.20:80            Route   1      0          2         
  -> 192.168.100.30:80            Route   1      0          2         
[root@stw ~]# ipvsadm -C
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn

（2）重新添加规则（RS1权重为3、RS2不设置权重）

[root@stw ~]# ipvsadm -A -t 192.168.100.100:80 -s wrr
[root@stw ~]# ipvsadm -a -t 192.168.100.100:80 -r 192.168.100.20 -g -w 3
[root@stw ~]# ipvsadm -a -t 192.168.100.100:80 -r 192.168.100.30 -g
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.100.100:80 wrr
  -> 192.168.100.20:80            Route   3      0          0         
  -> 192.168.100.30:80            Route   1      0          0         
[root@stw ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@stw ~]# systemctl restart ipvsadm

（3）客户端测试

[root@stw4 ~]# curl http://192.168.100.100
RS2
[root@stw4 ~]# curl http://192.168.100.100
RS1
[root@stw4 ~]# curl http://192.168.100.100
RS1
[root@stw4 ~]# curl http://192.168.100.100
RS1
[root@stw4 ~]# curl http://192.168.100.100
RS2

四、TUN模式（通过网络模式模拟隧道）

1、关闭防火墙selinux（DR、RS1、RS2略）

2、RS1、RS2部署httpd服务

以RS1为例：

[root@stw2 ~]# cd /etc/yum.repos.d/
[root@stw2 yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@stw2 yum.repos.d]# rm -rf *
[root@stw2 yum.repos.d]# vim server.repo
[root@stw2 yum.repos.d]# cat server.repo
[aa]
name=aa1
baseurl=file:///mnt
enabled=1
gpgcheck=0
[root@stw2 yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@stw2 yum.repos.d]# yum -y install httpd
[root@stw2 ~]# echo RS1 > /var/www/html/index.html
[root@stw2 ~]# cat /var/www/html/index.html
RS1
[root@stw2 ~]# systemctl restart httpd
[root@stw2 ~]# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

可以访问

[root@stw ~]# curl http://192.168.100.20
RS1
[root@stw ~]# curl http://192.168.100.30
RS2

3、DR安装ipvsadm

[root@stw ~]# cd /etc/yum.repos.d/
[root@stw yum.repos.d]# ls
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo
[root@stw yum.repos.d]# rm -rf *
[root@stw yum.repos.d]# vim server.repo
[root@stw yum.repos.d]# mount /dev/cdrom /mnt
mount: /dev/sr0 is write-protected, mounting read-only
[root@stw yum.repos.d]# cd
[root@stw ~]# yum -y install ipvsadm

4、开启IP转发，配置tun隧道接口IP

[root@stw ~]# vim /etc/sysctl.conf 
[root@stw ~]# sysctl -p
net.ipv4.ip_forward = 1
[root@stw ~]# ifconfig tunl0 192.168.100.55 broadcast 192.168.100.55 netmask 255.255.255.255 up
[root@stw ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:b9:a3:2a brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.10/24 brd 192.168.100.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::3233:2f91:158e:95c2/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:07:f1:30 brd ff:ff:ff:ff:ff:ff
5: tunl0@NONE: <NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
    inet 192.168.100.55/32 brd 192.168.100.55 scope global tunl0
       valid_lft forever preferred_lft forever

5、RS1、RS2启用ipip模块，也配置tun隧道接口IP

[root@stw2 ~]# modprobe ipip
[root@stw2 ~]# lsmod | grep ipip
ipip                   13465  0 
tunnel4                13252  1 ipip
ip_tunnel              25163  1 ipip


[root@stw3 ~]# modprobe ipip
[root@stw3 ~]# lsmod | grep ipip
ipip                   13465  0 
tunnel4                13252  1 ipip
ip_tunnel              25163  1 ipip

[root@stw2 ~]# ifconfig tunl0 192.168.100.55 broadcast 192.168.100.55 netmask 255.255.255.255 up


[root@stw3 ~]# ifconfig tunl0 192.168.100.55 broadcast 192.168.100.55 netmask 255.255.255.255 up

6、修改内核参数

[root@stw2 ~]# vim /etc/sysctl.conf 
[root@stw2 ~]# sysctl -p
net.ipv4.conf.tunl0.arp_ignore = 1
net.ipv4.conf.tunl0.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.tunl0.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0


[root@stw3 ~]# vim /etc/sysctl.conf 
[root@stw3 ~]# sysctl -p
net.ipv4.conf.tunl0.arp_ignore = 1
net.ipv4.conf.tunl0.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.tunl0.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0

7、DR上添加规则

[root@stw ~]# ipvsadm -A -t 192.168.100.55:80 -s rr
[root@stw ~]# ipvsadm -a -t 192.168.100.55:80 -r 192.168.100.20 -i
[root@stw ~]# ipvsadm -a -t 192.168.100.55:80 -r 192.168.100.30 -i
[root@stw ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.100.55:80 rr
  -> 192.168.100.20:80            Tunnel  1      0          0         
  -> 192.168.100.30:80            Tunnel  1      0          0         
[root@stw ~]# ipvsadm -Sn > /etc/sysconfig/ipvsadm
[root@stw ~]# systemctl restart ipvsadm.service 
[root@stw ~]# systemctl enable ipvsadm.service 
Created symlink from /etc/systemd/system/multi-user.target.wants/ipvsadm.service to /usr/lib/systemd/system/ipvsadm.service.

8、客户端测试

[root@stw4 ~]# curl http://192.168.100.55
RS2
[root@stw4 ~]# curl http://192.168.100.55
RS1
[root@stw4 ~]# curl http://192.168.100.55
RS2
[root@stw4 ~]# curl http://192.168.100.55
RS1

乐奇 Rokid 开放社区

更多推荐

CKEditor 4 isFileTransfer() 详解：精准区分文件粘贴与文本粘贴

isFileTransfer() 是 CKEditor 4.17.0 在 clipboard 插件中新增的 DataTransfer 判定 API，用于判断一次粘贴或拖放操作携带的剪贴板数据是否为"纯文件"传输。本文以 [isfiletransfer 手动测试文档](https://link.gitcode.com/i/cc596b3ec040cc787cce3ddc235485e9) 为骨架，结

乐奇 Rokid 开放社区

CRMEB 商城在 Mac M 系列芯片上的 Docker Compose 快速部署指南：环境搭建、容器配置与定时任务/长连接/队列启动全解析

本文基于 CRMEB 仓库中 [docker-compose/MacArm/README.md](https://link.gitcode.com/i/a408652ab19aa3522df87c6879d496a3) 编写，完整讲解如何在 Apple 芯片（M1/M2/M3 等 ARM 架构）Mac 上，利用 Docker Compose 一键拉起 CRMEB 商城所需的 MySQL、Redis

乐奇 Rokid 开放社区

总重仅28.9克！3D打印钛合金镜腿为运动AR眼镜电子元件腾出重量空间

乐奇 Rokid 开放社区

所有评论(0)

查看更多评论

2201_75894418

@2201_75894418

已为社区贡献8条内容

lvs负载均衡

2201_75894418

lvs负载均衡

一、配置lvs-nat模式的httpd负载集群—http

环境说明：

1、DR、RS1、RS2三台主机都关闭防火墙和selinux

2、配置ip信息

（1）将RS1、RS2的网关都改为DR的DIP的IP地址—192.168.100.10

（2）DR中添加一个网卡（仅主机模式—172.16.30.10）

DR主机中开启IP转发

3、后端RS1和RS2部署WEB服务器

（1）RS1、RS2都安装yum仓库，安装httpd

（2）分别对RS1、RS2写入网页

（3）客户端测试WEB服务器是否部署成功

4、配置DR

（1）安装ipvsadm

（2）添加规则

5、客户端测试（客户端改为仅主机模式----172.16.30.20）

二、配置lvs-nat模式的httpd负载集群—https

1、配置https

（1）在DR中生成一对密钥（将DR当做CA）

（2）RS1、RS2中下载mod_ssl，并创建/etc/httpd/ssl目录

（3）在RS1中生成证书签署请求，并发送给CA

在DR中查看

（4）CA签署证书

（5）将CA签署的证书httpd.crt和服务器的证书cacert.pem发送给RS1

（6）RS1中把RS1的证书和密钥发送给RS2

RS2中查看

（7）RS1、RS2中修改https的配置文件（更改完RS1中的配置文件之后直接scp到RS2中）

（8）起服务（查看端口443）

2、在DR中添加规则

3、客户端测试

三、配置lvs-dr模式的httpd负载集群

1、关闭防火墙selinux（DR、RS1、RS2）

以DR为例，其余略

2、RS1、RS2配置yum仓库安装httpd

以RS1为例：

3、配置DR

（1）开启IP转发

（2）添加IP（配置环回口IP地址）

4、RS上配置arp内核参数----避免请求时产生冲突

RS1和RS2上都需要操作

5、RS上配置VIP

6、添加路由信息（静态路由）

RS1:

RS2:

7、安装ipvsadm

8、添加并保存规则

9、客户端测试

扩展：添加权重

（1）先清空添加的规则

（2）重新添加规则（RS1权重为3、RS2不设置权重）

（3）客户端测试

四、TUN模式（通过网络模式模拟隧道）

1、关闭防火墙selinux（DR、RS1、RS2略）

2、RS1、RS2部署httpd服务

以RS1为例：

可以访问

3、DR安装ipvsadm

4、开启IP转发，配置tun隧道接口IP

5、RS1、RS2启用ipip模块，也配置tun隧道接口IP

6、修改内核参数

7、DR上添加规则

8、客户端测试

所有评论(0)

温馨提示：您尚未绑定手机号

2201_75894418