☰

仅具有 1 个 NIC 的机器上的 LVS DNS 负载平衡

tag-icon • tag-icon redhat load-balancing bind keepalived lvs
仅具有 1 个 NIC 的机器上的 LVS DNS 负载平衡

首先让我澄清一下，我只是一名软件开发人员，而不是管理员，因此我对网络配置以及这些类型的设置有一些了解（可以说是对概念的基本了解），但我并不是高手，所以如果这听起来愚蠢或不合理，请耐心等待。

我正在尝试在 RH7 上配置 keepalived，以平衡已设置绑定的 2 台服务器之间的 NDS 请求。在我迄今为止阅读的指南中，他们似乎使用了 2 个 NIC， 但我只有一个可用的。

参考：

硬件：

我在同一个网络上有 3 台机器，配置如下：

  • 1 台带有 1 个网卡的机器作为负载均衡器，真实 IP 192.168.0.1
  • 1 台带有 1 个网卡的机器作为主绑定服务器，真实 IP 192.168.0.2
  • 1 台具有 1 个 NIC 的机器作为主绑定服务器，真实 IP 192.168.0.3

还启用了转发net.ipv4.ip_forward = 1

Keepalived配置：

! This is a comment
! Configuration File for keepalived

global_defs {
   ! this is who emails will go to on alerts
   notification_email {
        [email protected]
        [email protected]
    ! add a few more email addresses here if you would like
   }
   notification_email_from [email protected]

   ! I use the local machine to relay mail
   smtp_server 127.0.0.1
   smtp_connect_timeout 30

   ! each load balancer should have a different ID
   ! this will be used in SMTP alerts, so you should make
   ! each router easily identifiable
   lvs_id LVS_EXAMPLE_01
}

! vrrp_sync_groups make sure that several router instances
! stay together on a failure - a good example of this is
! that the external interface on one router fails and the backup server
! takes over, you want the internal interface on the failed server
! to failover as well, otherwise nothing will work.
! you can have as many vrrp_sync_group blocks as you want.
vrrp_sync_group VG1 {
   group {
      VI_1
      VI_GATEWAY
   }
}

! each interface needs at least one vrrp_instance
! each vrrp_instance is a group of VIPs that are logically grouped
! together
! you can have as many vrrp_instaces as you want

vrrp_instance VI_1 {
        state MASTER
        interface eth0

        lvs_sync_daemon_inteface eth0

    ! each virtual router id must be unique per instance name!
        virtual_router_id 51

    ! MASTER and BACKUP state are determined by the priority
    ! even if you specify MASTER as the state, the state will
    ! be voted on by priority (so if your state is MASTER but your
    ! priority is lower than the router with BACKUP, you will lose
    ! the MASTER state)
    ! I make it a habit to set priorities at least 50 points apart
    ! note that a lower number is lesser priority - lower gets less vote
        priority 150

    ! how often should we vote, in seconds?
        advert_int 1

    ! send an alert when this instance changes state from MASTER to BACKUP
        smtp_alert

    ! this authentication is for syncing between failover servers
    ! keepalived supports PASS, which is simple password
    ! authentication
    ! or AH, which is the IPSec authentication header.
    ! I don't use AH
    ! yet as many people have reported problems with it
        authentication {
                auth_type PASS
                auth_pass example
        }

    ! these are the IP addresses that keepalived will setup on this
    ! machine. Later in the config we will specify which real
        ! servers  are behind these IPs
    ! without this block, keepalived will not setup and takedown the
    ! any IP addresses

        virtual_ipaddress {
                192.168.0.10
        ! and more if you want them
        }
}

! now I setup the instance that the real servers will use as a default
! gateway
! most of the config is the same as above, but on a different interface

vrrp_instance VI_GATEWAY {
        state MASTER
        interface eth0
        lvs_sync_daemon_inteface eth0 
        virtual_router_id 52
        priority 150
        advert_int 1
        smtp_alert
        authentication {
                auth_type PASS
                auth_pass example
        }
        virtual_ipaddress {
                192.168.0.11
        }
}

! now we setup more information about are virtual server
! we are just setting up one for now, listening on port 53 for dns
! requests.

! notice we do not setup a virtual_server block for the 192.168.0.10
! address in the VI_GATEWAY instance. That's because we are doing NAT
! on that IP, and nothing else.

virtual_server 192.168.0.10 53 {
    delay_loop 6

    ! use round-robin as a load balancing algorithm
    lb_algo rr

    ! we are doing NAT
    lb_kind NAT
    nat_mask 255.255.255.0

    protocol TCP

    ! there can be as many real_server blocks as you need

    real_server 192.168.0.2 53 {

    ! if we used weighted round-robin or a similar lb algo,
    ! we include the weight of this server

        weight 1

    ! here is a health checker for this server.
    ! we could use a custom script here (see the keepalived docs)
    ! but we will just make sure we can do a vanilla tcp connect()
    ! on port 53
    ! if it fails, we will pull this realserver out of the pool
    ! and send email about the removal
        TCP_CHECK {
            connect_timeout 3
            connect_port 53
        }
    }

    real_server 192.168.0.3 53 {

    ! if we used weighted round-robin or a similar lb algo,
    ! we include the weight of this server

        weight 1

    ! here is a health checker for this server.
    ! we could use a custom script here (see the keepalived docs)
    ! but we will just make sure we can do a vanilla tcp connect()
    ! on port 53
    ! if it fails, we will pull this realserver out of the pool
    ! and send email about the removal
        TCP_CHECK {
            connect_timeout 3
            connect_port 53
        }
    }
}

结论：

防火墙已禁用，机器之间的连接正常，keepalived 能够验证与 DNS 主服务器的简单 TCP 连接。我还能够dig myhost @192.168.0.2/3从负载平衡器执行，并得到正确的结果。

但是运行时dig myhost @192.168.0.10我得到了一个;; connection timed out; no servers could be reached。如果使用 1 个 NIC 就可以解决这个问题，我将非常感激任何可以帮助我克服这个问题的提示或建议，如果需要更多详细信息，请告诉我。

答案1

经过一番谷歌搜索后，我发现除了 TCP 之外，UDP 可能也是必需的，似乎确实如此（自我提醒：如果我使用了 tcpdump/tshark... 可能会有帮助）：

协议传输

DNS 主要使用端口号 53 上的用户数据报协议 (UDP) 来处理请求。DNS 查询由来自客户端的单个 UDP 请求和来自服务器的单个 UDP 回复组成。当响应数据大小超过 512 字节或执行区域传输等任务时，将使用传输控制协议 (TCP)。某些解析器实现对所有查询都使用 TCP。

同样的建议也来自这篇旧文章关于使用 keepalived 进行 DNS 负载平衡写于 2006 年。

因此，我在现有配置中添加了以下 UDP 配置：

virtual_server 192.168.0.10 53 {
    delay_loop 6

    ! use round-robin as a load balancing algorithm
    lb_algo rr

    ! we are doing NAT
    lb_kind NAT
    nat_mask 255.255.255.0

    protocol UDP

    ! there can be as many real_server blocks as you need

    real_server 192.168.0.2 53 {
        ! if we used weighted round-robin or a similar lb algo,
        ! we include the weight of this server
        weight 1
    }

    real_server 192.168.0.3 53 {
        ! if we used weighted round-robin or a similar lb algo,
        ! we include the weight of this server
        weight 1
    }
}

笔记： 在里面LVS mini 使用方法 PDF有一个明白了：

2.2. 陷阱：您需要一个外部客户端（director 和 realservers 无法访问虚拟服务）

由于 PDF 似乎也比较旧（2006 年），因此现在情况已不再如此。我现在能够挖来自负载均衡器本身，但是当使用来自同一网络的不同客户端计算机时，我得到了;; reply from unexpected source: 192.168.0.2#53, expected 192.168.0.10#53。我尝试了以下建议这个问题，但到目前为止还没有效果：

sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv4.vs.conntrack=1
iptables -t nat -A POSTROUTING -j MASQUERADE

从我目前收集到的信息来看，这可能与网络拓扑和 NAT 设置有关，但我还未弄清楚这一点。

看起来我还有一些工作要做，但至少我有一些工作要做，而且我现在知道 1 个 NIC 足以平衡 2 个 DNS 服务器的负载（至少对于我现在正在进行的测试而言）。

相关内容