lvs tun模式

最新推荐文章于 2025-08-13 14:11:28 发布

转载最新推荐文章于 2025-08-13 14:11:28 发布 · 123 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://blog.51cto.com/3639953/1580975

文章标签：

#网络

LVS/TUN的连接调度和管理与 LVS/NAT 中的一样，只是它的报文转发方法不同。调度器根据各个服务器的负载情况，动态地选择一台服务器，将请求报文封装在另一个IP报文中，再将封装后的IP报文转发给选出的服务器；服务器收到报文后，先将报文解封获得原来目标地址为VIP的报文，服务器发现VIP地址被配置在本地的IP隧道设备上，所以就处理这个请求，然后根据路由表将响应报文直接返回给客户。

以上介绍来自于互联网

看一下我们的测试小案例：

tun_server:

eth0:192.168.1.241

eth1: 10.0.2.20

vip:192.168.1.204

real_server1:

eth0:192.168.1.229

eth1：10.0.2.22

real_server2:

eth0:192.168.1.224

eth1:10.0.2.23

对vip访问通过点对点的方式传递给realserver，然后由realserver直接返回给客户端

tun_server配置：

XML/HTML代码

# cat lvs_tun.sh
#!/bin/bash
vip=192.168.1.204
RS1=192.168.1.229
RS2=192.168.1.224
ifconfig tunl0 $vip broadcast $vip netmask 255.255.255.255
route add -host $vip dev tunl0
echo "0" >/proc/sys/net/ipv4/ip_forward
echo "1" >/proc/sys/net/ipv4/conf/all/send_redirects
echo "1" >/proc/sys/net/ipv4/conf/default/send_redirects
echo "1" >/proc/sys/net/ipv4/conf/eth0/send_redirects
ipvsadm -C
ipvsadm -A -t $vip:80 -s wlc
ipvsadm -a -t $vip:80 -r $RS1 -i
ipvsadm -a -t $vip:80 -r $RS2 -i
/etc/init.d/ipvsadm save
/etc/init.d/ipvsadm restart

real_server配置：

XML/HTML代码

# cat tun.sh
#!/bin/bash
vip=192.168.1.204
ifconfig tunl0 $vip broadcast $vip netmask 255.255.255.255 up
echo '0' > /proc/sys/net/ipv4/ip_forward
echo '1' > /proc/sys/net/ipv4/conf/tunl0/arp_ignore
echo '2' > /proc/sys/net/ipv4/conf/tunl0/arp_announce
echo '1' > /proc/sys/net/ipv4/conf/all/arp_ignore
echo '2' > /proc/sys/net/ipv4/conf/all/arp_announce
echo '0' > /proc/sys/net/ipv4/conf/tunl0/rp_filter
echo '0' > /proc/sys/net/ipv4/conf/all/rp_filter

注意，虚拟机上测试时，realserver的防火墙一定要关闭！

测试：

XML/HTML代码

[root@localhost ~]# ipvsadm -lcn
IPVS connection entries
pro expire state source virtual destination
TCP 14:52 ESTABLISHED 192.168.1.228:59864 192.168.1.204:80 192.168.1.224:80
TCP 00:01 CLOSE 192.168.1.228:59863 192.168.1.204:80 192.168.1.224:80
TCP 00:01 CLOSE 192.168.1.228:59861 192.168.1.204:80 192.168.1.224:80
TCP 00:02 CLOSE 192.168.1.228:59862 192.168.1.204:80 192.168.1.229:80
TCP 14:52 ESTABLISHED 192.168.1.228:59865 192.168.1.204:80 192.168.1.229:80
[root@localhost ~]# ipvsadm -ln --rate
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port CPS InPPS OutPPS InBPS OutBPS
-> RemoteAddress:Port
TCP 192.168.1.204:80 0 3 0 450 0
-> 192.168.1.224:80 0 1 0 228 0
-> 192.168.1.229:80 0 1 0 222 0
[root@localhost ~]# ipvsadm -l
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.1.204:http wlc
-> 192.168.1.224:http Tunnel 1 1 1
-> 192.168.1.229:http Tunnel 1 1 1

本来想打realserver的防火墙，结果还是杯具了，操作是这样的：

XML/HTML代码

iptables -I INPUT -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

XML/HTML代码

# iptables -vnL
Chain INPUT (policy DROP 318 packets, 37640 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 127.0.0.1 127.0.0.1
114 8928 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 1/sec burst 5
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 1/sec burst 5
Chain OUTPUT (policy ACCEPT 1 packets, 108 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
96 13576 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain icmp_allowed (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0