LVS负载均衡中利用防火墙标记解决HTTP/HTTPS会话不一致问题

利用火墙标记解决轮询错误1.在rs主机中同时开始http和https两种协议#在RS1和RS2中开启https[rootRS1RS2 ~]# dnf install mod_ssl -y[rootRS1RS2 ~]# systemctl restart httpd[rootRS1RS2 ~]# systemctl restart httpd2.在vsnode中添加https的轮询策略[rootvsnode boot]# ipvsadm -A -t 192.168.0.200:80 -s rr[rootvsnode boot]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20 -g[rootvsnode boot]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10 -g[rootvsnode boot]# ipvsadm -A -t 192.168.0.200:443 -s rr[rootvsnode boot]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.10:443 -g[rootvsnode boot]# ipvsadm -a -t 192.168.0.200:443 -r 192.168.0.20:443 -g[rootvsnode boot]# ipvsadm -LnIP Virtual Server version1.2.1(size4096)Prot LocalAddress:Port Scheduler Flags -RemoteAddress:Port Forward Weight ActiveConn InActConn TCP192.168.0.200:80 rr -192.168.0.10:80 Route100-192.168.0.20:80 Route100TCP192.168.0.200:443 rr -192.168.0.10:443 Route100-192.168.0.20:443 Route1003.轮询错误展示[rootclient ~]# curl 192.168.0.200;curl -k https://192.168.0.200RS2 -192.168.0.20 RS2 -192.168.0.20#当上述设定完成后http和https是独立的service轮询会出现重复问题解决方案使用火墙标记访问vip的80和443的所有数据包设定标记为6666然后对此标记进行负载[rootvsnode boot]# iptables -t mangle -A PREROUTING -d 192.168.0.200 -p tcp -m multiport --dports 80,443 -j MARK --set-mark 6666[rootvsnode boot]# ipvsadm -A -f 6666 -s rr[rootvsnode boot]# ipvsadm -a -f 6666 -r 192.168.0.10 -g[rootvsnode boot]# ipvsadm -a -f 6666 -r 192.168.0.20 -g#测试在客户端[rootclient ~]#[rootClient ~]# for i in {1..10};do curl 192.168.0.200; curl -k https://192.168.0.200;doneRS1 RS2 RS2 RS1 RS2 RS2 RS1 RS2 RS2 RS1 RS2 RS2 RS1 RS2 RS2 RS1 RS2 RS2 RS1 RS2