系統：CentOS5.6
HA:Keepalived 1.1.17
IP:
VIP:
10.0.1.250
10.0.1.251
DR(DIR):
10.0.1.120
10.0.1.121
Realserver(RIP):
10.0.1.122
10.0.1.123
Client(CIP):
10.0.1.203
配置
iptables -F
iptables -t nat -F
建議在LVS之上使用硬件防火牆，在本機上使用iptables會影響系統的性能。
DR:
1.配置yum源
ipvsadm 是Cluster人的一個軟件包
yum install -y ipvsadm
2.安裝keepalived
注：keepalived不會對語法進行檢測，即使錯誤也不會有提示信息，所以書寫過程中一定要認真。
DR1#tar fvxz keepalived-1.1.17.tar.gz
DR1#yum install kernel-devel ipvsadm -y (不裝一會安裝會有問題)
DR1#ln -s /usr/src/kernels/2.6.18-238.el5-x86_64/ /usr/src/linux
DR1#cd keepalived-1.1.17
DR1#./configure --prefix=/usr/local/keepalived
DR1#make
DR1#make install
安裝後，把人家提供好的文件進行對應的複製！
DR1#cp /usr/local/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/
DR1#cp /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
DR1#mkdir -pv /etc/keepalived
DR1#cp /usr/local/keepalived/etc/keepalived/keepalived.conf /etc/keepalived/
DR1#ln -s /usr/local/keepalived/sbin/keepalived /sbin/
同樣的安裝步驟在DR2上執行一次！
Keepalived配置文件
DR1----->MASTER DR2------>BACKUP
! Configuration File for keepalived global_defs { router_id dr1 } vrrp_sync_group web122 { group { apache122 } } vrrp_sync_group web123 { group { apache123 } } vrrp_instance apache122 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.1.250 } } virtual_server 10.0.1.250 80 { delay_loop 6 lb_algo rr lb_kind DR protocol TCP real_server 10.0.1.122 80 { weight 1 TCP_CHECK { connect_timeout 3 connect_port 80 } } } vrrp_instance apache123 { state BACKUP interface eth0 virtual_router_id 52 priority 99 advert_int 1 authentication { auth_type PASS auth_pass 2222 } virtual_ipaddress { 10.0.1.251 } } virtual_server 10.0.1.251 80 { delay_loop 6 lb_algo rr lb_kind DR protocol TCP real_server 10.0.1.123 80 { weight 1 TCP_CHECK { connect_timeout 3 connect_port 80 } } } | ! Configuration File for keepalived global_defs { router_id dr2 } vrrp_sync_group web122 { group { apache122 } } vrrp_sync_group web123 { group { apache123 } } vrrp_instance apache123 { state MASTER interface eth0 virtual_router_id 52 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 2222 } virtual_ipaddress { 10.0.1.251 } } virtual_server 10.0.1.251 80 { delay_loop 6 lb_algo rr lb_kind DR protocol TCP real_server 10.0.1.123 80 { weight 1 TCP_CHECK { connect_timeout 3 connect_port 80 } } } vrrp_instance apache122 { state BACKUP interface eth0 virtual_router_id 51 priority 99 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.1.250 } } virtual_server 10.0.1.250 80 { delay_loop 6 lb_algo rr lb_kind DR protocol TCP real_server 10.0.1.122 80 { weight 1 TCP_CHECK { connect_timeout 3 connect_port 80 } } } |
注：使用ipvsadm -ln 進行查看
Forward ：
Route 爲 DR模式
msq （masquerading） 爲NAT模式
使用-A添加VIP
ipvsadm -A -t VIP:80 -s 算法
使用 -E 選項修改VIP
使用-a 添加realserver
ipvsadm -a -t VIP:80 -r RIP -m
使用-s 添加算法
ipvsadm -A -t VIP:80 -s 算法
使用 -e 可修改權重
ipvsadm -e -t VIP:80 -r RIP -w 100
使用-D刪除VIP
RealServer1配置：
注：如果有路由器，需要將網關指向路由器
如路由器：eth0爲公網地址 eth1爲內網地址
route add default gw eth1爲內網地址
route add -host 10.0.1.250 dev lo:0
ifconfig lo:0 10.0.1.250 netmask 255.255.255.255 broadcast 10.0.1.250 up
修改內核參數，可以寫入開機腳本或sysctl.conf。（/etc/rc.local）
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
RealServer2配置：
注：如果有路由器，需要將網關指向路由器
如路由器：eth0爲公網地址 eth1爲內網地址
route add default gw eth1爲內網地址
route add -host 10.0.1.251 dev lo:0
ifconfig lo:0 10.0.1.251 netmask 255.255.255.255 broadcast 10.0.1.251 up
修改內核參數，可以寫入開機腳本或sysctl.conf。（/etc/rc.local）
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
sysctl.conf
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
sysctl -p 使當前生效
腳本：
#!/bin/bash
VIP1=10.0.1.250
ROUTE=路由接口地址
start() {
ifconfig lo:0 $VIP1/32 broadcast $VIP up
route add -host $VIP1 dev lo:0
route add default gw $ROUTE
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo start;
}
stop() {
route del default gw $ROUTE
route del -host $VIP1 dev lo:0
ifconfig lo:0 down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo stop;
}
case $1 in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
*)
echo 'start | stop'
esac
注：可將腳本放入/etc/init.d下，如：service vip start
解決無用的廣播包太多，造成DR無法綁定vip
DR1上執行
iptables -F
iptables -A INPUT -m ttl --ttl-eq 255 -j REJECT
iptables -I INPUT -s 10.0.1.121 -j ACCEPT
DR2上執行
iptables -F
iptables -A INPUT -m ttl --ttl-eq 255 -j REJECT
iptables -I INPUT -s 10.0.1.120 -j ACCEPT