Linux Virtual Server NAT模型的实现

你的名字 2022-05-24 05:25 124阅读 0赞

*  查看内核是否具有`ipvs`的功能  
    ![这里写图片描述][70]
 *  从这里可以看到`IP_VS`支持的协议以及支持的十种算法,并且自带了支持`FTP`协议的模块,上面是内核提供的模块,如果不存在,就需要自行编译内核;
 *  接下来需要安装,用户空间的管理工具`ipvsadm`

[root@server21 ~]# yum install ipvsadm -y

*  `ipvsadm`的功能:
    
     *  管理集群服务
        
         *  添加:
            
             *  `-A`:表示添加集群服务
                
                 *  `-t`:`TCP`协议的集群,`service-address: IP:Port`;
                 *  `-u`:`UDP`协议的集群,`service-address: IP:Port`;
                 *  `-f`:`FWM`防火墙标记`(Fire Wall Mark)LVS`的持久连接有关,`service-address:Mark Number`;
                 *  `-s`:表示用于指定调度方法;
                 *  例如:`ipvsadm -A -t 172.25.23.21:80 -s rr`;
         *  修改:
            
             *  `-E`:
         *  删除:
            
             *  `-D`: `-t | -u | f service-address`,直接可以用于删除某个服务;
     *  管理集群服务中的`Real Server`;
        
         *  添加: `-a -t | u | f service-address -r server-address [-g|i|m] [-w weight] [-x upper] [-y lower]`
            
             *  `-a`:
                
                 *  `-t` `server-address`
                 *  `-u`: `server-address`
                 *  `-f`:`server-address`
                 *  `-r`:`server-address`,某`RS`的地址,在`NAT`模型中,可使用`IP:Port`进行端口映射;
                 *  `-g`:表示`DR`模型;
                 *  `-i`:表示`TUN`模型
                 *  `-m`:表示`NAT`模型;
                 *  `-w`:用于说明权重;
                 *  `-x`:用于时设置连接的阀值的最大值;
                 *  `-y`:用于设置连接的阀值的最小值;
                 *  例如:`ipvsadm -a -t 172.25.23.100:80 -r 192.168.10.1 | 2`
         *  修改:`-e -t|u|f service-address -r server-addres [-g|i|m] [-w weight] [-x upper] [-y lower]`
         *  删除:
            
             *  `-d -t|u|f service-address -r server-address`
     *  查看服务的规则:
        
         *  `-L`:
            
             *  `-n`:表示数字格式显示`IP`地址和端口号,不进行反解;
             *  `--state`:显示统计信息;
             *  `--rate`:表示用于显示速率;
             *  `--timeout`:用于显示`TCP(UDP)`协议的会话超时时间时长;
             *  `--sort`:对于集群服务进行排序;
             *  `-c`:用于显示连接状态的;
     *  `-Z`:用于清空统计信息包括上面显示 的速率等等信息;
     *  `-C`:表示用于清空`IPvs`规则;
     *  `-S`:用于保存的生效的规则,通常是`#ipvsadm -S > /path/to/somewhere` ;
     *  `-R`:用于载入此前生效的规则,例如:`# ipvsadm -R < /path/to/somewhere`;
 *  按照下面的规划实现`NAT`模型  
    ![这里写图片描述][70 1]
 *  这里修改关于`IP`地址的规划:
    
     *  `VIP`地址为:`172.25.23.21`,`GIP`为`192.168.10.100`;
     *  `RIP1`为`192.168.10.1`,`RIP2`为`192.168.10.2`;
 *  根据上面的配置,首先更改`LVS`主机的地址为`VIP`以及`GIP`
 *  更改`VIP`,可以使用`setuptools`进行修改,或者通过修改配置文件进行修改
 *  选择`Network`的选项  
    ![这里写图片描述][70 2]
 *  选择`Device`的选项:  
    ![这里写图片描述][70 3]
 *  选择`eth0`;  
    ![这里写图片描述][70 4]
 *  配置`IP`地址如下:  
    ![这里写图片描述][70 5]
 *  底下是`eth0`的配置文件信息

[root@server21 ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0 
    DEVICE=eth0
    HWADDR=52:54:00:62:3a:95
    TYPE=Ethernet
    UUID=b093f393-3eae-43fc-8d4d-b7f980324778
    ONBOOT=yes
    NM_CONTROLLED=yes
    BOOTPROTO=none
    IPADDR=172.25.23.21
    PREFIX=24
    NETMASK=255.255.255.0
    IPV6INIT=no
    USERCTL=no
    GATEWAY=172.25.23.24

*  配置`eth1`的文件信息如下  
    ![这里写图片描述][70 6]
 *  `eth1`的配置文件信息如下

DEVICE=eth1
    BOOTPROTO=none
    NETMASK=255.255.255.0
    TYPE=Ethernet
    HWADDR=52:54:00:73:bb:96
    IPADDR=192.168.10.100

*  **补充关于KVM虚拟机添加虚拟网卡**
 *  首先命令行输入

[root@my Desktop]# virt-manager

![这里写图片描述][70 7]

*  找到需要添加虚拟网卡的虚拟机,并且进行双击

![这里写图片描述][70 8]

*  选择右下角的`Add HardWare`,选择网卡并且选择网卡类型  
    ![这里写图片描述][70 9]
 *  **回到正题**
 *  配置好网段之后,然后需要重新启动网络服务,并且查看网络地址

[root@server21 ~]# /etc/init.d/network restart

![这里写图片描述][70 10]

*  接下来配置`Real Server`的`IP`地址
 *  `RIP1 192.168.10.1`,并且配置`RIP2 192.168.10.2`;  
    ![这里写图片描述][70 11]

![这里写图片描述][70 12]

*  按照规划已经配置好所有主机的`IP`地址;
 *  **REAL SERVER提供服务**
 *  提供`httpd`以及`telnet-server`服务
 *  `RS 1`:

[root@server10 ~]# yum install httpd telnet-server -y

*  `RS2`:

[root@server20 ~]# yum install httpd telnet-server -y

*  因为i这里配置的是`NAT`模式,所以`RS`的网关指向`LVS`
 *  `RS1`:

[root@server10 ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0 
    
    DEVICE=eth0
    HWADDR=52:54:00:07:F3:6F
    TYPE=Ethernet
    UUID=39920ff6-c429-459b-9a06-274cff582c2e
    ONBOOT=yes
    NM_CONTROLLED=yes
    BOOTPROTO=static
    IPADDR=192.168.10.1
    PREFIX=24
    GATEWAY=192.168.10.100
    
    //重新启动网络服务
    [root@server10 ~]# /etc/init.d/network restart
    Shutting down interface eth0:                              [  OK  ]
    Shutting down loopback interface:                          [  OK  ]
    Bringing up loopback interface:                            [  OK  ]
    Bringing up interface eth0:  Determining if ip address 192.168.10.1 is already in use for device eth0...
                                                               [  OK  ]
    //查看路由信息
    [root@server10 ~]# route 
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    192.168.10.0    *               255.255.255.0   U     0      0        0 eth0
    link-local      *               255.255.0.0     U     1002   0        0 eth0
    default         192.168.10.100  0.0.0.0         UG    0      0        0 eth0

*  `RS 2`:

[root@server20 ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0 
    DEVICE=eth0
    HWADDR=52:54:00:03:aa:77
    TYPE=Ethernet
    UUID=69ac772e-21b8-4ba0-a1a2-3f3aeb4d76f8
    ONBOOT=yes
    NM_CONTROLLED=yes
    BOOTPROTO=none
    IPADDR=192.168.10.2
    PREFIX=24
    NETMASK=255.255.255.0
    IPV6INIT=no
    USERCTL=no
    GATEWAY=192.168.10.100
    
    //重新启动网络服务
    [root@server20 ~]# /etc/init.d/network restart
    Shutting down interface eth0:                              [  OK  ]
    Shutting down loopback interface:                          [  OK  ]
    Bringing up loopback interface:                            [  OK  ]
    Bringing up interface eth0:  Determining if ip address 192.168.10.2 is already in use for device eth0...
                                                               [  OK  ]
    
    //查看路由信息
    [root@server20 ~]# route -n 
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
    169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
    0.0.0.0         192.168.10.100  0.0.0.0         UG    0      0        0 eth0

*  接下来为每个`RS`提供`httpd`的配置页面

[root@server10 ~]# echo "RS 1 server" > /var/www/html/index.html
    [root@server10 ~]# /etc/init.d/httpd start
    Starting httpd:                                            [  OK  ]
    
    [root@server20 ~]# /etc/init.d/httpd start
    Starting httpd:                                            [  OK  ]

*  确保服务本地访问正常  
    ![这里写图片描述][70 13]

![这里写图片描述][70 14]

*  确定`LVS`可以和`RS 1`以及`RS 2`进行通信  
    ![这里写图片描述][70 15]

![这里写图片描述][70 16]

*  确保`HTTP`服务访问正常  
    ![这里写图片描述][70 17]
 *  `LVS`确定网卡间转发打开

[root@server21 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward 
    [root@server21 ~]# cat /proc/sys/net/ipv4/ip_forward
    1

*  `LVS`上面接下来添加集群服务,并且添加集群节点

[root@server21 ~]# ipvsadm -A -t 172.25.23.21:80 -s rr 
    [root@server21 ~]# ipvsadm -a -t 172.25.23.21:80 -r 192.168.10.1 -m 
    [root@server21 ~]# ipvsadm -a -t 172.25.23.21:80 -r 192.168.10.2 -m

*  通过文本进行浏览器的访问操作

[root@my Desktop]# curl http://172.25.23.21
    RS 2 server
    [root@my Desktop]# curl http://172.25.23.21
    RS 1 server
    [root@my Desktop]# curl http://172.25.23.21
    RS 2 server

*  查看`LVS`监控到的信息

![这里写图片描述][70 18]

*  通过浏览器进行访问  
    ![这里写图片描述][70 19]
 *  查看统计信息  
    ![这里写图片描述][70 20]
 *  修改规则,添加权重

[root@server21 ~]# ipvsadm -E -t 172.25.23.21:80 -s wrr
    [root@server21 ~]# ipvsadm -e -t 172.25.23.21:80 -r 192.168.10.1 -m -w 3
    [root@server21 ~]# ipvsadm -e -t 172.25.23.21:80 -r 192.168.10.2 -m -w 3

*  查看修改之后的规则  
    ![这里写图片描述][70 21]
 *  使用简单的命令测试服务器的性能

[root@server21 ~]# ab -n 1000 -c 100 http://172.25.23.21/index.html
    This is ApacheBench, Version 2.3 <$Revision: 655654 $>
    Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
    Licensed to The Apache Software Foundation, http://www.apache.org/
    
    Benchmarking 172.25.23.21 (be patient)
    Completed 100 requests
    Completed 200 requests
    Completed 300 requests
    Completed 400 requests
    Completed 500 requests
    Completed 600 requests
    Completed 700 requests
    Completed 800 requests
    Completed 900 requests
    Completed 1000 requests
    Finished 1000 requests
    
    
    Server Software:        Apache/2.2.15
    Server Hostname:        172.25.23.21
    Server Port:            80
    
    Document Path:          /index.html
    Document Length:        21 bytes
    
    Concurrency Level:      100
    Time taken for tests:   0.622 seconds
    Complete requests:      1000
    Failed requests:        749
       (Connect: 0, Receive: 0, Length: 749, Exceptions: 0)
    Write errors:           0
    Total transferred:      288829 bytes
    HTML transferred:       20293 bytes
    Requests per second:    1608.13 [#/sec] (mean)
    Time per request:       62.184 [ms] (mean)
    Time per request:       0.622 [ms] (mean, across all concurrent requests)
    Transfer rate:          453.59 [Kbytes/sec] received
    
    Connection Times (ms)
                  min  mean[+/-sd] median   max
    Connect:        0    5   5.8      4      82
    Processing:     0   48  28.8     60     101
    Waiting:        0   47  28.6     58     101
    Total:          1   54  28.7     65     105
    
    Percentage of the requests served within a certain time (ms)
      50%     65
      66%     68
      75%     70
      80%     76
      90%     90
      95%     95
      98%    100
      99%    102
     100%    105 (longest request)

*  查看监控的状态  
    ![这里写图片描述][70 22]

[70]: /images/20220524/6c0e4ab813e2445483302a3c64355860.png
[70 1]: /images/20220524/4af69a3e61d042c882076cab9a6c3636.png
[70 2]: /images/20220524/d8d4de6fd15647748a6da83b5f8e4171.png
[70 3]: /images/20220524/517de37ae8554391aa58f9883bb755ac.png
[70 4]: /images/20220524/c69a31a2306742e7a238a62d52dd0625.png
[70 5]: /images/20220524/6b32f672182342479f146aa4386bd55d.png
[70 6]: /images/20220524/49242747498644e7840af0b38a1553a9.png
[70 7]: /images/20220524/45498c9b3c3b4559985c4fa8b60cd4b8.png
[70 8]: /images/20220524/c38817d50536437985f9720ad072ff90.png
[70 9]: /images/20220524/a2fbf171d94a483eb28347333740f0b9.png
[70 10]: /images/20220524/0490f5994fef45b3b4303d84f5257b61.png
[70 11]: /images/20220524/cd23bde216e841ee9ef0a3193a0a86c7.png
[70 12]: /images/20220524/97452514cbc74a7aaa9712fb5bf72ca3.png
[70 13]: /images/20220524/ae45a014ad2a446f9f2abdbcc0388055.png
[70 14]: /images/20220524/6b21c11d0159478493b4d4a25d1d10e2.png
[70 15]: /images/20220524/4fc55a5e762c452d8a0d40c14b060686.png
[70 16]: /images/20220524/69c82080d67d479fb9551cd9aad38a88.png
[70 17]: /images/20220524/5b02c5e1f9f44f19b5542cea091f5a48.png
[70 18]: /images/20220524/4fa6962ab1d94e19a842cec5a4f25766.png
[70 19]: /images/20220524/5b3396b2a1904efbb0313cc07aba331c.png
[70 20]: /images/20220524/5f82dba42c7a48f09306ab9b559ede39.png
[70 21]: /images/20220524/02c641c44cb4446e8ad8245338fea128.png
[70 22]: /images/20220524/53b28ab8e6734934b60d5540bfd06099.png