LVSNAT模式

VSVirtual Server调度器RSReal Server真实业务主机CIPClient IP客户端主机的ipVIP: Virtual serve IP VS外网的IP对外开放的让客户访问的ipDIP: Director IP VS内网的IP调度器负责访问内网的ipRIP: Real server IP真实业务主机IPlvs集群的类型lvs-nat修改请求报文的目标IP,多目标IP的DNATlvs-dr操纵封装新的MAC地址lvs-tun在原请求IP报文之外新加一个IP首部lvs-fullnat修改请求报文的源和目标IPIvs-nat:本质是多目标IP的DNAT通过将请求报文中的目标地址和目标端口修改为某挑出的RS的RIP和PORT实现转发RIP和DIP应在同一个IP网络且应使用私网地址;RS的网关要指向DIP请求报文和响应报文都必须经由Director转发Director易于成为系统瓶颈支持端口映射可修改请求报文的目标PORTVS必须是Linux系统RS可以是任意OS系统VS主机中[rootvsnode ~]# vmset.sh eth0 172.25.254.100 vsnode[rootvsnode ~]# vmset.sh eth1 192.168.0.100 vsnode norouteRS1#设定网络[rootRS1 ~]# vmset.sh eth0 192.168.0.10 RS1 noroute[rootRS1 ~]# nmcli connection modify eth0 ipv4.gateway 192.168.0.100[rootRS1 ~]# nmcli connection reload[rootRS1 ~]# nmcli connection up eth0[rootRS1 ~]# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0#设定访问业务真实数据[rootRS1 ~]# dnf install httpd -y[rootRS1 ~]# systemctl enable --now httpd[rootRS1 ~]# echo RS1 - 192.168.0.10 /var/www/html/index.htmlRS2#设定网络[rootRS1 ~]# vmset.sh eth0 192.168.0.20 RS1 noroute[rootRS1 ~]# nmcli connection modify eth0 ipv4.gateway 192.168.0.100[rootRS1 ~]# nmcli connection reload[rootRS1 ~]# nmcli connection up eth0[rootRS1 ~]# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 192.168.0.100 0.0.0.0 UG 100 0 0 eth0192.168.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0#设定访问业务真实数据[rootRS1 ~]# dnf install httpd -y[rootRS1 ~]# systemctl enable --now httpd[rootRS1 ~]# echo RS2 - 192.168.0.20 /var/www/html/index.html在vs主机中测试环境[rootvsnode ~]# curl 192.168.0.10RS1 - 192.168.0.10[rootvsnode ~]# curl 192.168.0.20RS2 - 192.168.0.20NAT模式实现方法1.vs#1开启内核路由功能[rootvsnode ~]# echo net.ipv4.ip_forward1 /etc/sysctl.conf[rootvsnode ~]# sysctl -pnet.ipv4.ip_forward 1#2.编写策略[rootvsnode ~]# ipvsadm -C[rootvsnode ~]# ipvsadm -A -t 172.25.254.100:80 -s wrr[rootvsnode ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.10:80 -m -w 1[rootvsnode ~]# ipvsadm -a -t 172.25.254.100:80 -r 192.168.0.20:80 -m -w 1[rootvsnode ~]# ipvsadm -LnIP Virtual Server version 1.2.1 (size4096)Prot LocalAddress:Port Scheduler Flags- RemoteAddress:Port Forward Weight ActiveConn InActConnTCP 172.25.254.100:80 wrr- 192.168.0.10:80 Masq 1 0 0- 192.168.0.20:80 Masq 1 0 0#测试[rootvsnode ~]# for i in {1..10};do curl 172.25.254.100;doneRS2 - 192.168.0.20RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10#更改权重[rootvsnode ~]# ipvsadm -e -t 172.25.254.100:80 -r 192.168.0.10:80 -m -w 2[rootvsnode ~]# ipvsadm -LnIP Virtual Server version 1.2.1 (size4096)Prot LocalAddress:Port Scheduler Flags- RemoteAddress:Port Forward Weight ActiveConn InActConnTCP 172.25.254.100:80 wrr- 192.168.0.10:80 Masq 2 0 5- 192.168.0.20:80 Masq 1 0 5#测试[rootvsnode ~]# for i in {1..10};do curl 172.25.254.100;doneRS2 - 192.168.0.20RS1 - 192.168.0.10RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10RS1 - 192.168.0.10RS2 - 192.168.0.20RS1 - 192.168.0.10RS1 - 192.168.0.10RS2 - 192.168.0.20规则持久化实验过程可以用过打开另外一个shell的并执行监控命令的方式进行观察[rootvsnode ~]# watch -n 1 ipvsadm -Ln#利用自定义文件进行持久化[rootvsnode ~]# ipvsadm-save -n-A -t 172.25.254.100:80 -s wrr-a -t 172.25.254.100:80 -r 192.168.0.10:80 -m -w 2-a -t 172.25.254.100:80 -r 192.168.0.20:80 -m -w 1[rootvsnode ~]# ipvsadm-save -n /mnt/ipvs.rule[rootvsnode ~]# ipvsadm -C[rootvsnode ~]# ipvsadm-restore /mnt/ipvs.rule#利用守护进程进行规则持久化[rootvsnode ~]# ipvsadm-save -n /etc/sysconfig/ipvsadm[rootvsnode ~]# ipvsadm -C[rootvsnode ~]# systemctl enable --now ipvsadm.serviceCreated symlink /etc/systemd/system/multi-user.target.wants/ipvsadm.service → /usr/lib/systemd/system/ipvsadm.service.