LVS模式二：TUN隧道模式

隧道模式

client ->vs ->Rs -> client

• IP隧道（IP tunneling）是将一个IP报文封装在另一个IP报文的技术，这可以使得目标为一个IP地址的数据报文能被封装和转发到另一个IP地址。
• IP隧道技术亦称为IP封装技术（IP encapsulation）。
• IP隧道主要用于移动主机和虚拟私有网络（Virtual Private Network），在其中隧道都是静态建立的，隧道一端有一个IP地址，另一端也有唯一的IP地址

---

主机环境：

主机名	IP
server1	172.25.254.1
server2	172.25.254.2
server3	172.25.254.3

---

TUN 模式LVS的配置：

• 配置server1调度器：
  详见之前LVS-DR模式的配置：https://blog.youkuaiyun.com/weixin_43287982/article/details/87531490
• 在虚拟服务器上配置高级yum源
• 在server1（虚拟服务器）上安装ipvsadm（调度器）

[root@server1 ~]# vim /etc/yum.repos.d/rhel-source.repo 
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.254.60/rhel6.5
enabled=1
gpgcheck=0

[LoadBalancer]        ##负载均衡
name=LoadBalancer
baseurl=http://172.25.254.60/rhel6.5/LoadBalancer
enabled=1
gpgcheck=0

[root@server1 yum.repos.d]# yum clean all
[root@server1 yum.repos.d]# yum repolist

[root@server1 ~]# yum install ipvsadm -y 

• 添加隧道
• 隧道添加对外暴露的VIP
• 隧道激活

[root@server1 ~]# modprobe ipip   ##加载模块

##删除上一个实验绑定的vip，此处可忽略
[root@server1 ~]# ip addr del 172.25.254.100/24 dev eth0
[root@server1 ~]# ip addr add 172.25.254.100/24  dev tunl0
 
[root@server1 ~]# ip link set up tunl0

• 在server上清除之前的策略重新添加新的策略

[root@server1 ~]# ipvsadm -C   ##清除策略
[root@server1 ~]# ipvsadm -A -t 172.25.254.100:80 -s rr    #添加vip，对后端服务器采用rr算法
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.254.2:80 -i    #添加后端真实服务器server2
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.254.3:80 -i    #添加后端真实服务器server3

[root@server1 ~]# /etc/init.d/ipvsadm save    ##保存策略

• server2:
• 安装apache服务，编写默认发布目录，启动服务

[root@server2 ~]# yum install httpd -y
[root@server2 ~]# vim /var/www/html/index.html
[root@server2 ~]# cat /var/www/html/index.html
server2
[root@server2 ~]# /etc/init.d/httpd start

[root@server2 ~]# yum install arptables_jf -y
[root@server2 ~]# arptables -A IN -d 172.25.254.100 -j DROP
[root@server2 ~]# arptables -A OUT -s 172.25.254.100 -j mangle --mangle-ip-s 172.25.254.2
[root@server2 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables:          [  OK  ]

• 添加隧道
• 隧道添加对外暴露的VIP
• 隧道激活

[root@server2 ~]# modprobe ipip
[root@server2 ~]# ip addr del 172.25.254.100/32 dev eth0
[root@server2 ~]# ip addr add 172.25.254.100/32 dev tunl0
[root@server2 ~]# ip link set up tunl0

• 在server2上修改rp_filter参数

[root@server2 ~]# sysctl -a |grep rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 1
net.ipv4.conf.tunl0.arp_filter = 0

[root@server2 ~]# sysctl -w net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.rp_filter = 0
[root@server2 ~]# sysctl -w net.ipv4.conf.lo.rp_filter=0
net.ipv4.conf.lo.rp_filter = 0
[root@server2 ~]# sysctl -w net.ipv4.conf.eth0.rp_filter=0
net.ipv4.conf.eth0.rp_filter = 0
[root@server2 ~]# sysctl -w net.ipv4.conf.tunl0.rp_filter=0
net.ipv4.conf.tunl0.rp_filter = 0

[root@server2 ~]# sysctl -p		##刷新
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

[root@server2 ~]# sysctl -a |grep rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0

• 注意：重新加载后，有一个参数始终不为0，需要在文件中修改

[root@server2 ~]# sysctl -p   ##重新加载后
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

[root@server2 ~]# sysctl -a |grep rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1   ##始终不为0，则这个需要在文件中改
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0

[root@server2 ~]# vim /etc/sysctl.conf 
# Controls source route verification
net.ipv4.conf.default.rp_filter = 0

[root@server2 ~]# sysctl -p

[root@server2 ~]# sysctl -a |grep rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.default.rp_filter = 0  ##修改成功了
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0

• 为什么要修改这个参数呢？

• rp_filter参数用于控制系统是否开启对数据包源地址的校验。

• 有三个值，0、1、2，具体含义：

  • 0：不开启源地址校验。
  • 1：开启严格的反向路径校验。对每个进来的数据包，校验其反向路径是否是最佳路径。如果反向路径不是最佳路径，则直接丢弃该数据包。
  • 2：开启松散的反向路径校验。对每个进来的数据包，校验其源地址是否可达，即反向路径是否能通（通过任意网口），如果反向路径不同，则直接丢弃该数据包。

• server3:

• 和server2上是一样的操作步骤

---

测试