8.8作业

LVS 四层结构（最多实现到iso第四层：传输层的功能

 部署NAT模式集群案例

[root@lvs ~]# sysctl -a | grep ip_forward  #改成1打开内核路由功能
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0

net.ipv4.ip_forward=0 

[root@lvs ~]# cat /etc/sysctl.conf 
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
[root@lvs ~]# vim /etc/sysctl.conf 
-bash: vim: command not found
[root@lvs ~]# vi  /etc/sysctl.conf 
[root@lvs ~]# sysctl -p   #查看命令
net.ipv4.ip_forward = 1

 server2

 server1

 [root@server1 ~]# dnf install httpd -y

[root@server1 ~]# echo " webserver1 - 192.168.0.10" > /var/www/html/index.html
[root@server1 ~]# systemctl restart httpd

[root@server1 ~]# systemctl stop firewalld
[root@server2 ~]# echo " webserver1 - 192.168.0.10" > /var/www/html/index.html  #其他的与server1相同

要添加端口

 [root@lvs ~]# ipvsadm -A -t 172.25.250.100:80 -s rr

[root@lvs ~]# ipvsadm -a -t 172.25.250.100:80  -r 192.168.0.10:80 -m
[root@lvs ~]# ipvsadm -a -t 172.25.250.100:80  -r 192.168.0.20:80 -m
 

 部署DR模式集群案例

[root@server1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@server1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce 

[root@server1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
 [root@server1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce   ##rs主机不对外响应 rs主机都要添加

[root@lvs ~]# ip a a 192.168.0.200/32 dev lo #在lvs主机中和rs主机中添加vip

[root@server1 ~]# ip a a 192.168.0.200/32 dev lo  #临时修改ip命令 一定要32

[root@server2 ~]#  ip a a 192.168.0.200/32 dev lo
 

[root@lvs ~]# ipvsadm -A -t 192.168.0.200:80 -s wrr #权重算法
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g -w 1
[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g -w 2
 

[root@lvs ~]# ipvsadm -A -t 192.168.0.200:80 -s rr

[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.20:80 -g

[root@lvs ~]# ipvsadm -a -t 192.168.0.200:80 -r 192.168.0.10:80 -g

 FO调度算法：静态；常用作灰度发布

2.OVF调度算法：动态；

lvs火墙标记：

在webserver1 和 webserver2 上

[root@server1 ~]#  dnf install mod_ssl -y
[root@server1 ~]# echo " webserver1 172.25.250.10" >/var/www/html/index.html
[root@server1 ~]# ip a a 172.25.250.200 dev lo
[root@server1 ~]# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[root@server1 ~]# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[root@server1 ~]# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce 
[root@server1 ~]# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore 
 

 下图是lvs

 在lvs上

[root@haproxy ~]# ipvsadm -A -t 172.25.250.200:80 -s rr
[root@haproxy ~]# ipvsadm -a -t 172.25.250.200:80 -r 172.25.250.10:443 -g
[root@haproxy ~]# ipvsadm -a -t 172.25.250.200:80 -r 172.25.250.20:443 -g
[root@haproxy ~]# ipvsadm -A -t 172.25.250.200:443 -s rr
[root@haproxy ~]# ipvsadm -a -t 172.25.250.200:443 -r 172.25.250.20:443 -g
[root@haproxy ~]# ipvsadm -a -t 172.25.250.200:443 -r 172.25.250.10:443 -g
[root@haproxy ~]# ipvsadm -LN
 

 [root@localhost ~]# curl 172.25.254.200;curl -k https://172.25.254.200
webserver2 - 172.25.254.20
webserver2 - 172.25.254.20
[root@localhost ~]# curl 172.25.254.200;curl -k https://172.25.254.200
webserver1 - 172.25.254.10
webserver1 - 172.25.254.10  俩字访问都是同一个

 在lvs上修改

 [root@haproxy ~]# iptables -t mangle -A PREROUTING -d 172.25.250.200 -p tcp -m multiport --dports  80,443 -j MARK --set-mark 66
[root@haproxy ~]# iptables -t mangle -nL

[root@haproxy ~]# ipvsadm -C
[root@haproxy ~]# ipvsadm -A -f 66 -s rr
[root@haproxy ~]# ipvsadm -a -f 66 -r 172.25.250.10 -g
[root@haproxy ~]# ipvsadm -a -f 66 -r 172.25.250.20 -g
[root@haproxy ~]# ipvsadm -Ln

在client

haproxy七层代理 

实验环境搭建

[root@haproxy ~]# dnf install haproxy -y

[root@server1 ~]# dnf installl nginx -y #server主机使用nginx
[root@server1 ~]# echo " webserver 1 172.25.2550.10" > /usr/share/nginx/html/index.html
[root@server2 ~]# echo " webserver 2 172.25.2550.20" > /usr/share/nginx/html/index.html

在haproxy

 #frontend webcluster
 #  bind *:80
  # mode http
  # use_backend webcluster-host
#backend webcluster-host
 #  balance roundrobin
  # server web1 172.25.250.10:80
  # server web2 172.25.250.20:80
listen webcluster  #俩着都可以
    bind *:80
    mode http
    balance roundrobin
    server web1 172.25.250.10:80
    server web2 172.25.250.20:80

 要把frontend main全部注销

 nbproc 2  #启用多进程
 cpu-map 1 0 #进程和cpu核心绑定防止cpu抖动从而减少资源消耗
 cpu-map 2 1 #表示第二个进程，1表示第二个cpu核心

 nbthread 2 #启用多线程
 

haproxy日志分离 

定义全局的syslog 服务器;日志服务器需要开启UDP协议

 [root@haproxy ~]# vi /etc/rsyslog.conf  #日志配置文件
[root@haproxy ~]# systemctl restart rsyslog.service 
[root@haproxy ~]# ll /var/log/hawkey.log 
-rw-r--r--. 1 root root 1200 Aug  8 11:23 /var/log/hawkey.log