lvs-nat及lvs-dr实验

Posted 2021-12-08

LVS-nat实验

实验拓扑：

环境准备：
Client配置172.22.23.10网卡，网关指向LVS
LVS配置VIP与DIP，开启核心转发功能
后端RS1与RS1配置对应的RIP，并将网关指向LVS
测试Client与RS1、RS2是否能够相互ping通

LVS主机配置：
[[email protected] ~ 18:56:44]#yum -y install ipvsadm
[[email protected] ~ 18:58:19]#ipvsadm -A -t 172.22.23.20:80 -s rr
[[email protected] ~ 18:58:44]#ipvsadm -a -t 172.22.23.20:80 -r 192.168.0.30:80 -m
[[email protected] ~ 18:59:03]#ipvsadm -a -t 172.22.23.20:80 -r 192.168.0.40:80 –m

RS1主机配置：
[[email protected] ~ 18:47:28]#yum -y install httpd
[[email protected] ~ 18:51:43]#echo "RS1" > /var/www/html/index.html
[[email protected] ~ 18:59:39]#service httpd start
RS2主机配置：
[[email protected] ~ 18:47:28]#yum -y install httpd
[[email protected] ~ 18:51:43]#echo "RS2" > /var/www/html/index.html
[[email protected] ~ 18:59:39]#service httpd start
验证成功：

下面来抓包，查询一次请求时包流动的整个过程
192.168.0.0/24网段抓包

172.22.0.0/16网段抓包

可以查看得知，CIP请求的VIP，VIP对CIP进行回应，整个过程就像是直接对172.22.23.20的httpd服务进行请求一样，其实在LVS中是通过调度至后端的服务器来进行响应的，连后端服务器也感觉就像是直接对CIP进行通信一样

lvs-dr实验
实验拓扑：

RS1配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up

RS2配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up

LVS配置：
[[email protected] ~ 21:11:20]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up
[[email protected] ~ 21:11:25]#ipvsadm -A -t 192.168.0.21:80 -s rr
[[email protected] ~ 21:11:51]#ipvsadm -a -t 192.168.0.21:80 -r 192.168.0.30
[[email protected] ~ 21:12:15]#ipvsadm -a -t 192.168.0.21:80 -r 192.168.0.40

验证：

下面来抓包查看报文流动的过程,黑色的表示被LVS修改目标MAC后转发的报文

Lvs-dr实验2
实验拓扑：

RS1配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up

RS2配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up

LVS配置：
[[email protected] ~ 21:11:20]#ifconfig lo:1 192.168.0.21 netmask 255.255.255.255 #broadcast 192.168.0.21 up
[[email protected] ~ 21:11:25]#ipvsadm -A -t 192.168.0.21:80 -s rr
[[email protected] ~ 21:11:51]#ipvsadm -a -t 192.168.0.21:80 -r 192.168.0.30
[[email protected] ~ 21:12:15]#ipvsadm -a -t 192.168.0.21:80 -r 192.168.0.40

Router配置：配置好ip地址，开启核心转发
[[email protected] ~ 22:35:43]#vim /etc/sysctl.conf
[[email protected] ~ 22:36:08]#sysctl -p

客户端配置：网关指向172.22.23.10
测试是否可ping通

测试请求VIP

这里的lvs-dr模式中的LVS的网关不一定要指向路由，网关的配置就是为了跨网段通信，因为它不需要跨网段通信，但不配置网关也不可以，因为tcp的三次握手请求syn过来 lvs中，lvs虽然实际不响应tcp三次握手的请求，但如果不配置网关，它就认为你无法进行三次握手，所以就不能通信了，所以可以欺骗式的配置假网关来欺骗tcp三次握手

lvs-dr实验VIP与DIP相同VLAN不同网段
实验拓扑：

RS1配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 172.16.0.20 netmask 255.255.255.255 #broadcast 172.16.0.20 up
[[email protected] ~ 21:05:48]#route add -net default gw 192.168.0.10

RS2配置：
[[email protected] ~ 21:05:20]#echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
[[email protected] ~ 21:05:47]#echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
[[email protected] ~ 21:05:47]#echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
[[email protected] ~ 21:05:48]#ifconfig lo:1 172.16.0.20 netmask 255.255.255.255 #broadcast 172.16.0.20 up
[[email protected] ~ 21:05:48]#route add -net default gw 192.168.0.10

lvs配置
[[email protected] ~ 21:11:20]#ifconfig lo:1 172.16.0.20 netmask 255.255.255.255 #broadcast 172.16.0.20 up
[[email protected] ~ 21:11:25]#ipvsadm -A -t 172.16.0.20:80 -s rr
[[email protected] ~ 21:11:51]#ipvsadm -a -t 172.16.0.20:80 -r 192.168.0.30:80
[[email protected] ~ 21:12:15]#ipvsadm -a -t 172.16.0.20:80 -r 192.168.0.40:80
[[email protected] ~ 21:05:48]#route add -net default gw 192.168.0.10

路由配置：
配置好172.22.23.10地址与192.168.0.10地址，在192.168.0.10地址在再绑定一个地址172.16.0.10，用于与lvs的172.16.0.20通信
[[email protected] ~ 21:05:48]#ifconfig eth1:0 172.16.0.21/16 up

客户端192.168.0.50测试：