centos7配置keepalive+lvs

拓扑图

用户访问www.abc.com解析到10.4.7.8，防火墙做DNAT将访问10.4.7.8:80的请求转换到VIP 172.16.10.7:80，负载均衡器再将请求转发到后端web服务器。

实验环境
在这里插入图片描述
VIP：负载均衡服务器的虚拟ip地址
LB ：负载均衡服务器
realserver：后端真实服务器

一、配置防火墙，先让内网服务器能上网

1、先确认网关服务器能上网

(1) 查看网关服务器ip地址
[root@gateway ~]# ifconfig ens33 |grep -w "inet"inet 10.4.7.8  netmask 255.255.255.0  broadcast 10.4.7.255
[root@gateway ~]# ifconfig ens37 |grep -w "inet"inet 172.16.10.8  netmask 255.255.255.0  broadcast 172.16.10.255(2) ping百度
[root@gateway ~]# ping www.baidu.com -c 2
PING www.a.shifen.com (39.156.66.14) 56(84) bytes of data.
64 bytes from 39.156.66.14 (39.156.66.14): icmp_seq=1 ttl=128 time=9.51 ms
64 bytes from 39.156.66.14 (39.156.66.14): icmp_seq=2 ttl=128 time=8.90 ms

2、防火墙开启路由转发，并配置NAT规则

(1) 开启路由转发
[root@gateway ~]# sed -i 's#net.ipv4.ip_forward = 0#net.ipv4.ip_forward = 1#g' /etc/sysctl.conf
[root@gateway ~]# sysctl -p(2) 配置SNAT让来自172.16.10.0/24的内网用户能上网（公网ip不固定就是用自动寻路）
[root@gateway ~]# iptables -t nat -A POSTROUTING -s 172.16.10.0/24 -j  MASQUERADE(3) 配置DNAT让访问目标地址是10.4.7.8:80的请求，跳转到VIP172.16.10.7:80
[root@gateway ~]# iptables -t nat -A PREROUTING -p tcp  -d 10.4.7.8 --dport 80 -j DNAT --to-destination 172.16.10.7:80
[root@gateway ~]# service iptables save

3、将所有内网服务器网关指向gateway服务器内网ip

(1) lvs-master
[root@lvs-master ~]# echo -e "GATEWAY=172.16.10.8\nDNS1=8.8.8.8" >> /etc/sysconfig/network-scripts/ifcfg-ens33 
[root@lvs-master ~]# systemctl restart network
[root@lvs-master ~]# ping www.baidu.com
PING www.wshifen.com (104.193.88.77) 56(84) bytes of data.
64 bytes from 104.193.88.77 (104.193.88.77): icmp_seq=1 ttl=127 time=198 ms(2) lvs-slave
[root@lvs-slave ~]# echo -e "GATEWAY=172.16.10.8\nDNS1=8.8.8.8" >> /etc/sysconfig/network-scripts/ifcfg-ens33 
[root@lvs-slave ~]# systemctl restart network
[root@lvs-slave ~]# ping www.baidu.com
PING www.wshifen.com (104.193.88.77) 56(84) bytes of data.
64 bytes from 104.193.88.77 (104.193.88.77): icmp_seq=2 ttl=127 time=218 ms(3) web1
[root@web1 ~]# echo -e "GATEWAY=172.16.10.8\nDNS1=8.8.8.8" >> /etc/sysconfig/network-scripts/ifcfg-ens33
[root@web1 ~]# systemctl restart network 
[root@web1 ~]# ping www.baidu.com
PING www.wshifen.com (104.193.88.77) 56(84) bytes of data.
64 bytes from 104.193.88.77 (104.193.88.77): icmp_seq=1 ttl=127 time=221 ms(4) web2
[root@web2 ~]# echo -e "GATEWAY=172.16.10.8\nDNS1=8.8.8.8" >> /etc/sysconfig/network-scripts/ifcfg-ens33
[root@web2 ~]# systemctl restart network
[root@web2 ~]# ping www.baidu.com
PING www.wshifen.com (104.193.88.77) 56(84) bytes of data.
64 bytes from 104.193.88.77 (104.193.88.77): icmp_seq=1 ttl=127 time=209 ms

二、配置keepalive+lvs

1、安装keepalived+lvs（keepalived和lvs 在一台服务器上，主备都安装）

(1) lvs-master
[root@lvs-master ~]# yum -y install keepalived   ipvsadm
[root@lvs-master ~]# keepalived -v                                     # 查看keepalived版本号
Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2
[root@lvs-master ~]# ipvsadm -v                                        # 查看ipvsadm版本号
ipvsadm v1.27 2008/5/15 (compiled with popt and IPVS v1.2.1)(2) lvs-slave
[root@lvs-slave ~]# yum -y install keepalived   ipvsadm
[root@lvs-slave ~]# keepalived -v
Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2
[root@lvs-slave ~]# ipvsadm -v
ipvsadm v1.27 2008/5/15 (compiled with popt and IPVS v1.2.1)

2、配置keepalived+lvs主、备（keepalived是专门为lvs设计的）

设置非抢占模式只在master上配置就可以

(1) 配置 lvs-master
[root@lvs-master ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak
[root@lvs-master ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {router_id LVS_DEVEL_01   # keepalive标识符，主备不能相同
}
vrrp_instance VI_1 {        # VRRP实例，主备必须相同state MASTER            # 角色，MASTER为主，BACKUP为备#state BACKUP            # 如果是非抢占模式要两边都为BACKUPinterface ens33         # 监听的网卡virtual_router_id 51    # 虚拟路由标识，主备必须相同priority 150            # 优先级，主要高于备#nopreempt               # 开启非抢占模式(在优先级高的上面配置)advert_int 1            # 主备同步检查间隔1秒authentication {        # 主备认证密码auth_type PASSauth_pass 1111}virtual_ipaddress {     172.16.10.7         # 设置虚拟ip地址}
}
################ 上面是keepalived设置，下面是lvs设置 ##################
virtual_server 172.16.10.7 80 {       # 基于上面的VIP创建虚拟服务器delay_loop 6                      # 健康检查时间lb_algo rr                        # 调度算法rr为轮训lb_kind DR                        # 负载均衡模式DR路由模式persistence_timeout 50            # 会话保持时间protocol TCP                      # 转发协议类型real_server 172.16.10.5 80 {      # 设置第一台后端web服务器weight 1                      # 设置web服务器权重HTTP_GET {                    # 设置健康检查页面，健康检查方式 常见有 TCP_CHECK, HTTP_GET, SSL_GET, MISC_CHECK(自定义脚本)url {path /index.html# digest的值这样生成 genhash -s 172.16.10.5 -p 80 -u /index.htmldigest d8cf4a4aed83e042d2b147561f1c83df}connect_timeout 8             # 设置响应超时时间nb_get_retry 3                # 设置超时重试次数delay_before_retry 3          # 设置超时重试间隔}}real_server 172.16.10.6 80 {      # 设置第二台后端web服务器weight 1                      # 设置web服务器权重HTTP_GET {                    # 设置健康检查页面url {path /index.html# digest的值这样生成 genhash -s 172.16.10.6 -p 80 -u /index.htmldigest  0583558e12e704650cd8bd72e0274347}connect_timeout 8             # 设置响应超时时间nb_get_retry 3                # 设置超时重试次数delay_before_retry 3          # 设置超时重试间隔}}
}---------------------------------------------------------------------------------------------------(2) 配置lvs-slave
[root@lvs-slave ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak
[root@lvs-slave ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {router_id LVS_DEVEL_02   # keepalive标识符，主备不能相同
}
vrrp_instance VI_1 {        # VRRP实例，主备必须相同state BACKUP             # 角色，MASTER为主，BACKUP为备interface ens33         # 监听的网卡virtual_router_id 51    # 虚拟路由标识，主备必须相同priority 90             # 优先级，主要高于备advert_int 1            # 主备同步检查间隔1秒authentication {        # 主备认证密码auth_type PASSauth_pass 1111}virtual_ipaddress {     172.16.10.7   # 设置虚拟ip地址}
}################ 上面是keepalived设置，下面是lvs设置 ##################
virtual_server 172.16.10.7 80 {       # 根据上面的VIP创建虚拟服务器delay_loop 6                      # 健康检查时间lb_algo rr                        # 调度算法rr为轮训lb_kind DR                        # 负载均衡模式DR路由模式persistence_timeout 50            # 会话保持时间protocol TCP                      # 转发协议类型real_server 172.16.10.5 80 {      # 设置第一台后端web服务器weight 1                      # 设置web服务器权重HTTP_GET {                    # 设置健康检查页面url {path /index.html# digest的值这样生成 genhash -s 172.16.10.5 -p 80 -u /index.htmldigest  d8cf4a4aed83e042d2b147561f1c83df}connect_timeout 8             # 设置响应超时时间nb_get_retry 3                # 设置超时重试次数delay_before_retry 3          # 设置超时重试间隔}}real_server 172.16.10.6 80 {      # 设置第二台后端web服务器weight 1                      # 设置web服务器权重HTTP_GET {                    # 设置健康检查页面url {path /index.html# digest的值这样生成 genhash -s 172.16.10.6 -p 80 -u /index.htmldigest  0583558e12e704650cd8bd72e0274347}connect_timeout 8             # 设置响应超时时间nb_get_retry 3                # 设置超时重试次数delay_before_retry 3          # 设置超时重试间隔}}
}

三、配置nginx服务器

1、配置web1

(1) 安装nginx
[root@web1 ~]# rpm -ivh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
[root@web1 ~]# yum -y install nginx(2) 增加虚拟主机
[root@web1 ~]# cat /etc/nginx/conf.d/www_abc_com.conf 
server {listen       80;server_name  www.abc.com;#access_log  /var/log/nginx/host.access.log  main;location / {root   /usr/share/nginx/html;index  index.html index.htm;}
}
[root@web1 ~]# echo "web1-172.16.10.5" > /usr/share/nginx/html/index.html(3) 配置vip，以及抑制ARP广播脚本
[root@web1 ~]# cat /etc/init.d/lvs_realserver 
#!/bin/sh  
VIP=172.16.10.7Usage ()
{echo "Usage:`basename $0` (start|stop)"exit 1
}if [ $# -ne 1 ];thenUsage
ficase $1 instart)echo "reparing for Real Server"echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignoreecho "2" >/proc/sys/net/ipv4/conf/all/arp_announceecho "1" >/proc/sys/net/ipv4/conf/ens33/arp_ignoreecho "2" >/proc/sys/net/ipv4/conf/ens33/arp_announce/sbin/ifconfig lo:0 $VIP netmask 255.255.255.255  up
#/sbin/route add -host $VIP dev lo:0;;stop)/sbin/ifconfig lo:0 downecho "0" >/proc/sys/net/ipv4/conf/all/arp_ignoreecho "0" >/proc/sys/net/ipv4/conf/all/arp_announceecho "0" >/proc/sys/net/ipv4/conf/ens33/arp_ignoreecho "0" >/proc/sys/net/ipv4/conf/ens33/arp_announceecho "stop Real Server";; *)Usage
esac

2、配置web2

(1) 安装nginx
[root@web2 ~]# rpm -ivh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
[root@web2 ~]# yum -y install nginx(2) 增加虚拟主机
[root@web2 ~]# cat /etc/nginx/conf.d/www_abc_com.conf 
server {listen       80;server_name  www.abc.com;#access_log  /var/log/nginx/host.access.log  main;location / {root   /usr/share/nginx/html;index  index.html index.htm;}
}
[root@web2 ~]# echo "web2-172.16.10.6" > /usr/share/nginx/html/index.html(3) 编写绑定vip和抑制ARP广播脚本
[root@web2 ~]# cat /etc/init.d/lvs_realserver 
#!/bin/sh  
VIP=172.16.10.7Usage ()
{echo "Usage:`basename $0` (start|stop)"exit 1
}if [ $# -ne 1 ];thenUsage
ficase $1 instart)echo "reparing for Real Server"echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignoreecho "2" >/proc/sys/net/ipv4/conf/all/arp_announceecho "1" >/proc/sys/net/ipv4/conf/ens33/arp_ignoreecho "2" >/proc/sys/net/ipv4/conf/ens33/arp_announce/sbin/ifconfig lo:0 $VIP netmask 255.255.255.255  up
#/sbin/route add -host $VIP dev lo:0;;stop)/sbin/ifconfig lo:0 downecho "0" >/proc/sys/net/ipv4/conf/all/arp_ignoreecho "0" >/proc/sys/net/ipv4/conf/all/arp_announceecho "0" >/proc/sys/net/ipv4/conf/ens33/arp_ignoreecho "0" >/proc/sys/net/ipv4/conf/ens33/arp_announceecho "stop Real Server";; *)Usage
esac

四、启动服务器

(1) 启动keepalive和lvs
[root@lvs-master ~]# systemctl start keepalived
[root@lvs-slave ~]# systemctl start keepalived(2) 启动nginx、启动绑定VIP并抑制ARP广播的脚本
[root@web1 ~]# systemctl start nginx
[root@web1 ~]# /etc/init.d/lvs_realserver start
[root@web1 ~]# ifconfig lo:0 |grep "inet"inet 172.16.10.7  netmask 255.255.255.255   # 已经绑定vip[root@web2 ~]# systemctl start nginx
[root@web2 ~]# /etc/init.d/lvs_realserver start
[root@web2 ~]# ifconfig lo:0 |grep "inet"inet 172.16.10.7  netmask 255.255.255.255(3) 查看keepalived当前的vip状态和监听的后端web节点
[root@lvs-master ~]# ip add
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UPinet 172.16.10.3/24 brd 172.16.10.255 scope global ens33   # 这是本机地址inet 172.16.10.7/32 scope global ens33    # keepalived已经绑定VIP成功[root@lvs-master ~]# ipvsadm -L
TCP  lvs-master:http rr persistent 50-> 172.16.10.5:http             Route   1      3          0     # 监听后端web1      -> 172.16.10.6:http             Route   1      0          0     # 监听后端web2