Basic knowledge of LVS/TUN working mode

IP隧道(Tunnel)模式（VS-TUN）  

    原理：互联网上的大多Internet服务的请求包很短小，而应答包通常很大。那么隧道模式就是，把客户端发来的数据包，封装一个新的IP头标记(仅目的IP)发给RS,RS收到后,先把数据包的头解开,还原数据包,处理后,直接返回给客户端,不需要再经过负载均衡器｡注意,由于RS需要对负载均衡器发过来的数据包进行还原,所以说必须支持IPTUNNEL协议｡所以,在RS的内核中,必须编译支持IPTUNNEL这个选项
    优点：负载均衡器只负责将请求包分发给后端节点服务器，而RS将应答包直接发给用户。所以，减少了负载均衡器的大量数据流动，负载均衡器不再是系统的瓶颈，就能处理很巨大的请求量，这种方式，一台负载均衡器能够为很多RS进行分发。而且跑在公网上就能进行不同地域的分发。
    缺点：隧道模式的RS节点需要合法IP，这种方式需要所有的服务器支持”IP Tunneling”(IPEncapsulation)协议，服务器可能只局限在部分Linux系统上。

Insert picture description here
Experiment description:

CPU name	ip	system	use
client	192.168.181.100	mac	Client
lvs-server	192.168.181.133	centos7.5	Distributor
real-server1	192.168.181.129	centos7.5	web1
real-server2	192.168.181.130	centos7.5	web2

On lvs-server

# 添加隧道模块
[root@lvs-server ~]# modprobe ipip
# 查看时多了一块网卡
[root@lvs-server ~]# ip a   

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:c2:34:dd brd ff:ff:ff:ff:ff:ff
    inet 192.168.181.133/24 brd 192.168.181.255 scope global noprefixroute dynamic ens33
3: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
# 在新网卡上面添加虚拟ip
[root@lvs-server ~]# ip addr add 192.168.181.200/32 dev tunl0
[root@lvs-server ~]# ip a
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:c2:34:dd brd ff:ff:ff:ff:ff:ff
    inet 192.168.181.133/24 brd 192.168.181.255 scope global noprefixroute dynamic ens33
3: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
    inet 192.168.181.200/24 scope global tunl0
       valid_lft forever preferred_lft forever
# 这里我们客户以看到 tunl0的网卡是DOWN的状态，现在我们激活它
[root@lvs-server ~]# ip link set up tunl0     # 激活tunl0网卡
[root@lvs-server ~]# ip addr show tunl0
[root@lvs-server ~]# yum install -y ipvsadm
[root@lvs-server ~]# ipvsadm -C 
[root@lvs-server ~]# ipvsadm -A -t 192.168.181.200:80 -s rr
[root@lvs-server ~]# ipvsadm -a -t 192.168.181.200:80 -r 192.168.181.129 -i  # -i隧道模式
[root@lvs-server ~]# ipvsadm -a -t 192.168.181.200:80 -r 192.168.181.130 -i
[root@lvs-server ~]# ipvsadm -L

The two real-servers are the same

[root@real-server1 ~]# modprobe ipip
[root@real-server1 ~]# ip addr add 192.168.181.200/32 dev tunl0
[root@real-server1 ~]# ip link set up tunl0
[root@real-server1 ~]# ip addr show
[root@real-server1 ~]# sysctl -a | grep rp_filter  # 查看反向检验参数，-a表示显示
[root@real-server1 ~]# sysctl -a | grep rp_filter
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.ens33.arp_filter = 0
net.ipv4.conf.ens33.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 1
[root@real-server1 ~]# sysctl -w net.ipv4.conf.all.rp_filter=0
[root@real-server1 ~]# sysctl -w net.ipv4.conf.lo.rp_filter=0
[root@real-server1 ~]# sysctl -w net.ipv4.conf.ens33.rp_filter=0
[root@real-server1 ~]# sysctl -w net.ipv4.conf.tunl0.rp_filter=0
[root@real-server1 ~]# vim /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 0
[root@real-server1 ~]# sysctl -p
net.ipv4.conf.default.rp_filter = 0
[root@real-server1 ~]# sysctl -a | grep rp_filter
#  检查是否全部为0

Client test

[root@client ~]# curl http://172.16.147.200/
nginx1
[root@client ~]# curl http://172.16.147.200/
nginx2
[root@client ~]# curl http://172.16.147.200/
nginx1
[root@client ~]# curl http://172.16.147.200/
nginx2

LVS/TUN working mode experimental operation

1. Environmental preparation

Four vmware virtual machines in nat mode, simulated public network ip communication

lvs-server-vip 192.168.138.200
lvs-server-dip 192.168.138.135
http-server-1-rip 192.168.138.133
http-server-2-rip 192.168.138.132
clint 192.168.138.131

2. lvs-server deployment

添加隧道模式
[root@lvs-server ~]# modprobe ipip
ip a 多了一块隧道网卡tunl0
在新的网卡上添加VIP(子网掩码要长)
ip a a 192.168.138.200/32 dev tunl0
激活tunl0网卡
ip link set up tunl0
配置ipvsadm负载均衡
yum -y install ipvsadm
ipvsadm -C
ipvsadm -A -t 192.168.138.200:80 -s rr
ipvsadm -a -t 192.168.138.200:80 -r 192.168.138.133:80 -i
ipvsadm -a -t 192.168.138.200:80 -r 192.168.138.132:80 -i
ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.138.200:80 rr
  -> 192.168.138.132:80      Tunnel  1  0  0         
  -> 192.168.138.133:80      Tunnel  1  0  0
ipvsadm-save > /etc/sysconfig/ipvsadm

3. Two web servers do the same configuration

(Except for the different website publishing pages, it is easy to distinguish)

modprobe ipip
ip a a 192.168.138.200/32 dev tunl0
ip link set up tunl0
sysctl -a | grep rp_filter  # 查看反向检验参数，-a表示显示
sysctl -a | grep rp_filter

net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.ens33.arp_filter = 0
net.ipv4.conf.ens33.rp_filter = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.tunl0.arp_filter = 0
net.ipv4.conf.tunl0.rp_filter = 1

sysctl -w net.ipv4.conf.all.rp_filter=0
sysctl -w net.ipv4.conf.lo.rp_filter=0
sysctl -w net.ipv4.conf.ens33.rp_filter=0
sysctl -w net.ipv4.conf.tunl0.rp_filter=0
vim /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 0
sysctl -p
net.ipv4.conf.default.rp_filter = 0
sysctl -a | grep rp_filter
#  检查是否全部为0
sysctl -w 让修改立即生效

4. Client access test

Insert picture description here

LVS#LVS/TUN working mode experiment

Article Directory