過程

client ->VS->RS->client(VS只做排程,RS為伺服器)

DR模式:直接路由,VS改寫請求報文的MAC地址,由排程演算法分配真實的伺服器,MAC地址改為真實伺服器的MAC地址

      伺服器將響應訊息直接傳送給客戶端.

原理詳情

1、通過在排程器VS上修改資料包的目的MAC地址實現轉發,CIP不變,目的地址仍然是VIP地址;（cip(cm，m代表mac地址）->vip(vm->RM,在2層鏈路層改變了mac地址來定位)）
2、請求的報文經過排程器,而伺服器響應處理後的報文無需經過排程器,因此併發訪問量大時使用效率很高(和NAT模式比)
3、因為DR模式是通過MAC地址改寫機制實現轉發,因此所有RS節點和排程器只能在一個局域網裡面
4、伺服器主機需要繫結VIP地址在LO介面上,且需要配置ARP抑制。
5、伺服器節點的預設閘道器不需要配置成LB,而是直接配置為上級路由的閘道器,能讓伺服器直接出網就可以。
6、因為DR模式的排程器僅做MAC地址的改寫,所以排程器就不能改寫目標埠,那麼伺服器就得使用和VIP相同的埠提供服務。

實驗環境

iptables和selinux關閉
redhat6.5
VS：server1 172.25.254.1
RS：server2 172.25.254.2
RS：server3 172.25.254.3
vip：172.25.254.100

VS:

[[email protected] ~]# yum install -y ipvsadm
[[email protected] ~]# iptables -L   //檢視iptables是否關閉
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[[email protected] ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
[

[email protected] ~]# ipvsadm -A -t 172.25.254.100:80 -s rr  
//-s排程演算法，預設為wlc加權排程演算法
[[email protected] ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.254.2:80 -g
//-a表示在新增虛擬服務中新增,-g表示使用直連模式
[[email protected] ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.254.3:80 -g
[[email protected] ~]# ipvsadm -ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:80 rr
  -> 172.25.254.2:80               Route   1      0          0         
  -> 172.25.254.380               Route   1      0          0    
[[email protected] ~]# ip addr add 172.25.254.100/24 dev eth0  //新增虛擬ip
[[email protected] ~]# ip addr
link/ether 52:54:00:9f:e0:90     
inet 172.25.254.1/24
inet 172.25.254.100/24

RS：

注意： RS上必須有vip才能建立連線

Server2:
[[email protected] ~]# /etc/init.d/httpd start
[[email protected] html]# cat index.html
www.westos.org-Server2
[[email protected] ~]# ip addr add 172.25.254.100/24 dev eth0
//新增虛擬ip，這裡是臨時新增
[[email protected] ~]# ip addr
link/ether 52:54:00:74:05:fc
inet 172.25.254.2/24 brd
inet 172.25.254.100/24   

Server3:
[[email protected] ~]# /etc/init.d/httpd start
[[email protected] html]# cat index.html
bbs.westos.org
[[email protected] ~]# ip addr add 172.25.254.100/24 dev eth0
[[email protected] ~]# ip addr
link/ether 52:54:00:10:6f:56
inet 172.25.254.3/24
inet 172.25.254.100/24

客戶端測試：

發現連線到的ip（VS和RS的ip都一樣）是隨機的，因為三臺server在同一VLAN下具有相同的vip，故不能保證每次都會訪問排程器server1

為了解決這個問題，需要設定禁止訪問連線RS

RS：

server2：
[[email protected] ~]# yum install arptables_jf -y
[[email protected] ~]# arptables -A IN -d 172.25.253.100 -j DROP  
//-A控制arp協議,IN新增策略,mangle轉換
[[email protected] ~]# arptables -A OUT -s 172.25.254.100 -j mangle --mangle-ip-s 172.25.254.2
[[email protected] ~]# /etc/init.d/arptables_jf save
[[email protected] ~]# cat /etc/sysconfig/arptables  
//此檔案存有arptables的記錄，關掉之後，重啟依舊存在

server3：
[[email protected] ~]# yum install arptables_jf -y
[[email protected] ~]# arptables -A IN -d 172.25.254.100 -j DROP
[[email protected] ~]# arptables -A OUT -s 172.25.254.100 -j mangle --mangle-ip-s 172.25.254.3
[[email protected] ~]# /etc/init.d/arptables_jf save

Vs對後端沒有健康檢查

方式一：用ldirectord解決此問題

VS：

[[email protected] ~]# yum install ldirectord-3.9.5-3.1.x86_64.rpm -y
[[email protected] ~]# rpm -ql ldirectord   //檢視配置檔案
/usr/share/doc/ldirectord-3.9.5/ldirectord.cf
[[email protected] ~]# cp /usr/share/doc/ldirectord-3.9.5/ldirectord.cf /etc/ha.d/
[[email protected] ~]# cd /etc/ha.d
[[email protected] ha.d]# ls
ldirectord.cf  resource.d  shellfuncs
[[email protected] ha.d]# vim ldirectord.cf  
virtual=172.25.254.100:80
    real=172.25.254.2:80 gate
    real=172.25.254.3:80 gate
    fallback=127.0.0.1:80 gate
    service=http
    protoccol=tcp
    checkport=80
    request="index.html"

[[email protected] ha.d]# ipvsadm -C  //清理規則
[[email protected] ha.d]# ipvsadm -l  //檢視是否清除
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
[[email protected] ha.d]# /etc/init.d/ldirectord start //再次開啟服務又可以加載出規則
[[email protected] ha.d]# ipvsadm -ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:80 rr
  -> 172.25.254.2:80               Route   1      0          0         
  -> 172.25.254.3:80               Route   1      0          0    
[[email protected] ha.d]# cd /var/www/html
[[email protected] html]# vim index.html
系統維護中......
//在客戶端curl 172.25.254.2測試時，RS輪詢，當關閉server2時，只訪問server3，RS都關閉時會訪問本地，而顯示“系統維護中......”

方式二：用keepalived軟體解決

再建立一個子盤server4：172.25.254.4

server1:
[[email protected] ~]# tar zxf keepalived-2.0.6.tar.gz
[[email protected] ~]# cd keepalived-2.0.6
[[email protected] keepalived-2.0.6]# ./configure --prefix=/usr/local/keepalived --with-init=SYSV
[[email protected] keepalived-2.0.6]# yum install openssl-devel
[[email protected] keepalived-2.0.6]# ./configure --prefix=/usr/local/keepalived --with-init=SYSV
[[email protected] keepalived-2.0.6]# make  //編譯
[[email protected] keepalived-2.0.6]# make install
[[email protected] keepalived-2.0.6]# ln -s /usr/local/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/
[[email protected] keepalived-2.0.6]# ln -s /usr/local/keepalived/etc/keepalived/ /etc/
[[email protected] keepalived-2.0.6]# ln -s /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
[[email protected] keepalived-2.0.6]# ln -s /usr/local/keepalived/sbin/keepalived /sbin/
[[email protected] keepalived-2.0.6]# cd /usr/local/
[[email protected] local]# scp -r keepalived/ server4:/usr/local/  將keepalived傳給server4
[[email protected] local]# cd /etc/init.d/
[[email protected] init.d]# chmod +x keepalived
[[email protected] init.d]# /etc/init.d/keepalived start  //開啟服務

server4:
[[email protected] ~]# ln -s /usr/local/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/
[[email protected] ~]# ln -s /usr/local/keepalived/etc/keepalived/ /etc/
[[email protected] ~]# ln -s /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
[[email protected] ~]# ln -s /usr/local/keepalived/sbin/keepalived /sbin/
[[email protected] ~]# chmod +x /usr/local/keepalived/etc/init.d/keepalived
[[email protected] local]# /etc/init.d/keepalived start

server1:
[[email protected] ~]# cd /etc/keepalived/
[[email protected] keepalived]# yum install mailx -y
[[email protected] keepalived]# vim keepalived.conf //內容如下
//Virtual_router_id虛擬路由id，Delay_loop後端的健康檢查，Persistence_timeout持續連線，一直保持協議磋商
global_defs {
   notification_email {
        [email protected]
        }
   notification_email_from [email protected]
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   #vrrp_strict             #註釋以放其修改防火牆規則
   vrrp_garp_interval 0
   vrrp_gna_interval 0

vrrp_instance VI_1 {
    state MASTER        //server4上為BACKUP          
    interface eth0
    virtual_router_id 35
    priority 100        #數值越大，優先順序越高 server4上為50
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100
        }
}

virtual_server 172.25.254.100 80 {       #VS的vip，服務啟動生效時自動新增
    delay_loop 3            #對後端的健康檢查時間
    lb_algo rr              #排程演算法
    lb_kind DR              #模式為DR
    #persistence_timeout 50     #註釋持續連線
    protocol TCP

real_server 172.25.254.2 80{     #RS
        weight 1
        TCP_CHECK{
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }
    real_server 172.25.25.3 80{
        weight 1
        TCP_CHECK{
            connect_timeout 3
            retry 3
            delay_before_retry 3
       }
    }
}
[[email protected] keepalived]# scp keepalived.conf server4:/etc/keepalived/
[[email protected] keepalived]# ip addr del 172.25.254.100/24 dev eth0
[[email protected] keepalived]# /etc/init.d/keepalived restart

高可用

[[email protected] keepalived]# /etc/init.d/keepalived stop
//關掉server1(也可使用echo c > /proc/sysrq-trigger破壞server1的核心使其不能使用)，客戶端檢視內容不會變化，因為server4接替了server1
[[email protected] keepalived]# cat /var/log/messages  //檢視server4的日誌

[[email protected] ~]# /etc/init.d/httpd stop  
//將兩個RS都關掉，則不能正常訪問，與ldirectord不同的是本地不會接替讓VS訪問