一、实验环境说明
1.1 硬件准备
-
虚拟机软件:VMware Workstation 17 Pro
-
系统镜像:RedHat 9.5
-
虚拟机配置:
-
5台虚拟机(1Client + 1LVS + 3RS)
-
内存:1GB以上
-
硬盘:20GB
-
网络适配器:按角色配置(详见下文)
-
二、网络拓扑与IP规划
2.1 节点规划表
主机名 | 角色 | 网络模式 | IP地址/掩码 | 网关 | 网卡命名 |
---|---|---|---|---|---|
client | 客户端 | 仅主机模式 | 192.168.128.100/24 | 192.168.128.2 | ens160 |
lvs | 负载均衡器 | 双网卡 | VIP:192.168.128.200/24 DIP:192.168.220.2/24 | 无需额外网关 | ens160(VIP) ens224(DIP) |
rs1 | 后端服务器 | NAT模式 | 192.168.220.7/24 | 192.168.220.2 | ens160 |
rs2 | 后端服务器 | NAT模式 | 192.168.220.17/24 | 192.168.220.2 | ens160 |
rs3 | 后端服务器 | NAT模式 | 192.168.220.27/24 | 192.168.220.2 | ens160 |
三、逐节点配置详解
▶ 3.1 客户端(client)配置
1.配置仅主机模式网卡
# 登录client虚拟机,修改主机名为client:
[root@localhost ~]# hostnamectl hostname client
# 查看:
[root@localhost ~]# nmcli c show
NAME UUID TYPE DEVICE
ens160 a04877ab-0ad0-3541-b02e-67e2636bcff3 ethernet ens160
lo 473398f4-9d4d-49d0-a320-eff2051d6f7b loopback lo
# 修改IP地址:
[root@localhost ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.128.100/24 ipv4.gateway 192.168.128.2 connection.autoconnect yes
[root@localhost ~]# nmcli c up ens160
查看配置:
[root@client ~]# ip addr show ens160
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:7a:ca:ba brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.128.100/24 brd 192.168.128.255 scope global noprefixroute ens160
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe7a:caba/64 scope link noprefixroute
valid_lft forever preferred_lft forever
2.安装curl测试工具(如果没有安装)
# 这里提示我已经成功安装,没有必要再次安装
[root@client ~]# dnf install curl -y
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.
AppStream 2.4 MB/s | 3.2 kB 00:00
BaseOS 2.6 MB/s | 2.7 kB 00:00
Package curl-7.76.1-31.el9.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
▶ 3.2 后端服务器(rs1/rs2/rs3)配置
1.配置rs1节点(rs2/rs3替换IP)
[root@localhost ~]# hostnamectl hostname rs1
[root@localhost ~]# nmcli c show
NAME UUID TYPE DEVICE
ens160 a04877ab-0ad0-3541-b02e-67e2636bcff3 ethernet ens160
lo a73b1708-a6f0-4f42-928a-26c76f5ca615 loopback lo
# 配置NAT网络(关键:网关指向LVS的DIP)
[root@localhost ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.220.7/24 ipv4.gateway 192.168.220.2 connection.autoconnect yes
[root@localhost ~]# nmcli c up ens160
1.1安装Nginx服务 :
# 安装Nginx服务
[root@rs1 ~]# dnf install nginx -y
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.
AppStream 3.1 MB/s | 3.2 kB 00:00
BaseOS 2.6 MB/s | 2.7 kB 00:00
Dependencies resolved.
========================================================================================================================
Package Architecture Version Repository Size
========================================================================================================================
Installing:
nginx x86_64 2:1.20.1-20.el9 AppStream 40 k
Installing dependencies:
nginx-core x86_64 2:1.20.1-20.el9 AppStream 574 k
nginx-filesystem noarch 2:1.20.1-20.el9 AppStream 11 k
redhat-logos-httpd noarch 90.4-2.el9 AppStream 18 k
Transaction Summary
========================================================================================================================
Install 4 Packages
Total size: 643 k
Installed size: 1.8 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Running scriptlet: nginx-filesystem-2:1.20.1-20.el9.noarch 1/4
Installing : nginx-filesystem-2:1.20.1-20.el9.noarch 1/4
Installing : nginx-core-2:1.20.1-20.el9.x86_64 2/4
Installing : redhat-logos-httpd-90.4-2.el9.noarch 3/4
Installing : nginx-2:1.20.1-20.el9.x86_64 4/4
Running scriptlet: nginx-2:1.20.1-20.el9.x86_64 4/4
Verifying : nginx-2:1.20.1-20.el9.x86_64 1/4
Verifying : nginx-core-2:1.20.1-20.el9.x86_64 2/4
Verifying : nginx-filesystem-2:1.20.1-20.el9.noarch 3/4
Verifying : redhat-logos-httpd-90.4-2.el9.noarch 4/4
Installed products updated.
Installed:
nginx-2:1.20.1-20.el9.x86_64 nginx-core-2:1.20.1-20.el9.x86_64 nginx-filesystem-2:1.20.1-20.el9.noarch
redhat-logos-httpd-90.4-2.el9.noarch
Complete!
1.2向index.html 中写入数据
向index.html 中写入数据(比如我们的IP),方便我们查看 :
# 写入数据
[root@rs1 ~]# echo "RS1: 192.168.220.7" > /usr/share/nginx/html/index.html
# 启动服务
[root@rs1 ~]# systemctl start nginx
1.3验证服务
curl 127.0.0.1 或者curl localhost 应返回"RS1: 192.168.220.7":
[root@rs1 ~]# curl 127.0.0.1
RS1: 192.168.220.7
2.配置rs2节点
[root@localhost ~]# hostnamectl hostname rs2
[root@localhost ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.220.17/24 ipv4.gateway 192.168.220.2 connection.autoconnect yes
[root@localhost ~]# nmcli c up ens160
......
...(其他步骤同rs1,替换IP为.17)
3.配置rs3节点
[root@localhost ~]# hostnamectl hostname rs3
[root@localhost ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.220.27/24 ipv4.gateway 192.168.220.2 connection.autoconnect yes
[root@localhost ~]# nmcli c up ens160
......
...(其他步骤同rs1,替换IP为.17)
▶ 3.3 LVS服务器配置
lvs服务器有两块网卡,第一块网卡采用仅主机模式,IP 地址为 192.168.128.200,第二块网卡采用 NAT 模式,IP 地址为192.168.220.2。
1.配置双网卡
# 修改主机名
[root@localhost ~]# hostnamectl hostname lvs
为了方便我们后续的操作我们可以将 Wired connection 1”的连接 ID 修改为“ens224”:
# 查看
[root@localhost ~]# nmcli c show
NAME UUID TYPE DEVICE
Wired connection 1 7daaf516-0718-300d-8045-dbf6b2f92ba2 ethernet ens224
ens160 a04877ab-0ad0-3541-b02e-67e2636bcff3 ethernet ens160
lo d638ea48-4c5c-49e3-ab96-0c67797b551d loopback lo
# 修改
[root@localhost ~]# nmcli c modify 'Wired connection 1' connection.id ens224
#再次查看
[root@localhost ~]# nmcli c show
NAME UUID TYPE DEVICE
ens224 7daaf516-0718-300d-8045-dbf6b2f92ba2 ethernet ens224
ens160 a04877ab-0ad0-3541-b02e-67e2636bcff3 ethernet ens160
lo d638ea48-4c5c-49e3-ab96-0c67797b551d loopback lo
1.2安装ipvsadm服务
下载我们需要用到的服务——ipvsadm:
[root@localhost ~]# dnf install ipvsadm -y
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.
AppStream 2.2 MB/s | 3.2 kB 00:00
BaseOS 2.7 MB/s | 2.7 kB 00:00
Dependencies resolved.
========================================================================================================================
Package Architecture Version Repository Size
========================================================================================================================
Installing:
ipvsadm x86_64 1.31-6.el9 AppStream 54 k
Transaction Summary
========================================================================================================================
Install 1 Package
Total size: 54 k
Installed size: 89 k
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : ipvsadm-1.31-6.el9.x86_64 1/1
Running scriptlet: ipvsadm-1.31-6.el9.x86_64 1/1
Verifying : ipvsadm-1.31-6.el9.x86_64 1/1
Installed products updated.
Installed:
ipvsadm-1.31-6.el9.x86_64
Complete!
1.3配置仅主机模式网卡:
# 配置VIP(ens160,仅主机模式)
[root@localhost ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.128.200/24 ipv4.gateway 192.168.128.2 ipv4.dns 223.5.5.5 connection.autoconnect yes
[root@localhost ~]# nmcli c up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
1.4配置NAT模式网卡:
# 配置DIP(ens224,NAT模式)
[root@lvs ~]# nmcli c modify ens224 ipv4.method manual ipv4.addresses 192.168.220.2/24 connection.autoconnect yes
[root@lvs ~]# nmcli c up ens224
1.5 验证双网卡配置
[root@lvs ~]# ip a show ens160 | grep "inet "
inet 192.168.128.200/24 brd 192.168.128.255 scope global noprefixroute ens160
[root@lvs ~]# ip a show ens224 | grep "inet "
inet 192.168.220.2/24 brd 192.168.220.255 scope global noprefixroute ens224
2.开启内核转发
[root@lvs ~]# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
[root@lvs ~]# sysctl -p
net.ipv4.ip_forward = 1
3.配置ipvsadm
3.1创建虚拟服务:
# 创建虚拟服务(VIP:80)
[root@lvs ~]# ipvsadm -A -t 192.168.128.200:80 -s rr
# 添加真实服务器(-m表示NAT模式)
[root@lvs ~]# ipvsadm -a -t 192.168.128.200:80 -r 192.168.220.7:80 -m -w 1
[root@lvs ~]# ipvsadm -a -t 192.168.128.200:80 -r 192.168.220.17:80 -m -w 1
[root@lvs ~]# ipvsadm -a -t 192.168.128.200:80 -r 192.168.220.27:80 -m -w 1
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.128.200:80 rr
-> 192.168.220.7:80 Masq 1 0 0
-> 192.168.220.17:80 Masq 1 0 0
-> 192.168.220.27:80 Masq 1 0 0
3.2启动服务:
[root@lvs ~]# ipvsadm-save > /etc/sysconfig/ipvsadm
[root@lvs ~]# systemctl start ipvsadm
3.3查看规则:
ipvsadm -Ln
# 查看规则
[root@lvs ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.128.200:80 rr
-> 192.168.220.7:80 Masq 2 0 0
-> 192.168.220.17:80 Masq 2 0 0
-> 192.168.220.27:80 Masq 2 0 0
四、全流程测试验证
▶ 4.1 客户端发起请求
在client虚拟机执行: for i in {1..6}; do curl -s 192.168.128.200; done
[root@client ~]# curl 192.168.128.200
RS1: 192.168.220.7
[root@client ~]# curl 192.168.128.200
RS3: 192.168.220.27
[root@client ~]# for i in {1..6}; do curl -s 192.168.128.200; done
RS2: 192.168.220.17
RS1: 192.168.220.7
RS3: 192.168.220.27
RS2: 192.168.220.17
RS1: 192.168.220.7
RS3: 192.168.220.27
预期结果:
RS2: 192.168.220.17
RS1: 192.168.220.7
RS3: 192.168.220.27
RS2: 192.168.220.17
RS1: 192.168.220.7
RS3: 192.168.220.27
▶ 4.2 LVS监控流量
在lvs虚拟机执行:watch -n 1 ipvsadm -Ln --stats
实时显示:
Every 1.0s: ipvsadm -Ln --stats lvs: Fri Mar 28 15:06:36 2025
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Conns InPkts OutPkts InBytes OutBytes
-> RemoteAddress:Port
TCP 192.168.128.200:80 13 80 40 5190 4675
-> 192.168.220.7:80 4 25 12 1617 1413
-> 192.168.220.17:80 4 25 12 1617 1398
-> 192.168.220.27:80 5 30 16 1956 1864
五、排错指南
5.1 常见问题及解决
问题现象 | 排查步骤 |
---|---|
客户端无法连接VIP | 1. 检查LVS的ens160网卡IP是否为192.168.128.200 2. telnet 192.168.128.200 80 测试端口 |
RS节点无响应 | 1. 在RS执行ip route show 确认网关指向LVS的DIP(192.168.220.2)2. 检查RS的nginx是否运行 |
LVS转发不生效 | 1. 执行sysctl net.ipv4.ip_forward 确认返回12. 检查iptables是否拦截流量 |
5.2 防火墙配置
- 暂时关闭防火墙。
- 使用
setenforce 0
可以暂时降低 SELinux 的安全强度,但也不会关闭它。
# systemctl stop firewalld.service
# setenforce 0
六、扩展知识
6.1 LVS调度算法
-
rr (Round Robin):轮询(默认)
-
wrr (Weighted RR):加权轮询
-
lc (Least Connections):最少连接
-
sh (Source Hashing):源地址哈希
6.2 动态权重调整
将rs1权重调整为3
ipvsadm -e -t 192.168.128.200:80 -r 192.168.220.7:80 -m -w 3
原创声明
技术原创:一人一萧十只猫�
原文链接:在NAT模式下使用LVS实现三台Real Server的负载均衡 | 超详细实战指南-优快云博客
转载请联系作者授权,并保留本声明。