☰

使用 IPTabels 进行负载平衡不起作用

tag-icon • tag-icon networking server iptables firewall
使用 IPTabels 进行负载平衡不起作用

我有一个带有三个接口的 Ubuntu 服务器（19.04 / 5.0.0-15-generic）。

eth0: LAN  (192.168.10.253/24)  
eth1: WAN1 (172.29.13.201/24, gateway .253)  
eth2: WAN2 (172.29.14.201/24, gateway .253)

当我在 Debian (9.9 / 5.0.0-15-generic) 上运行以下脚本时，负载均衡器正在运行。我获得了 20/20+20/20= 40/40 的连接。

但是，当我在 Ubuntu 上运行相同的脚本时。负载平衡正在运行，流量通过 eth1 和 eth2 进行网络地址转换。但是返回的流量从未到达客户端，我在 eth1 和 eth2 中看到返回的流量，但在 eth0 中看不到。

我使用以下脚本来设置 iptables 和 IP-Routes。

#!/bin/bash

echo 1 >| /proc/sys/net/ipv4/ip_forward
echo 0 >| /proc/sys/net/ipv4/conf/all/rp_filter

#   flush all iptables entries
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT

# initialise chains that will do the work and log the packets
iptables -t mangle -N CONNMARK1
iptables -t mangle -A CONNMARK1 -j MARK --set-mark 1
iptables -t mangle -A CONNMARK1 -j CONNMARK --save-mark
iptables -t mangle -A CONNMARK1 -j LOG --log-prefix 'iptables-mark1: ' --log-level info

iptables -t mangle -N CONNMARK2
iptables -t mangle -A CONNMARK2 -j MARK --set-mark 2
iptables -t mangle -A CONNMARK2 -j CONNMARK --save-mark
iptables -t mangle -A CONNMARK2 -j LOG --log-prefix 'iptables-mark2: ' --log-level info

iptables -t mangle -N RESTOREMARK
iptables -t mangle -A RESTOREMARK -j CONNMARK --restore-mark
iptables -t mangle -A RESTOREMARK -j LOG --log-prefix 'restore-mark: ' --log-level info

iptables -t nat -N SNAT1
iptables -t nat -A SNAT1 -j LOG --log-prefix 'snat-to-172.29.13.201: ' --log-level info
iptables -t nat -A SNAT1 -j SNAT --to-source 172.29.13.201

iptables -t nat -N SNAT2
iptables -t nat -A SNAT2 -j LOG --log-prefix 'snat-to-172.29.14.201: ' --log-level info
iptables -t nat -A SNAT2 -j SNAT --to-source 172.29.14.201

#   iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE


# restore the fwmark on packets that belong to an existing connection
iptables -t mangle -A PREROUTING -i eth0 \
     -m state --state ESTABLISHED,RELATED -j RESTOREMARK


# if the mark is zero it means the packet does not belong to an existing connection
iptables -t mangle -A PREROUTING -m state --state NEW \
     -m statistic --mode nth --every 2 --packet 0 -j CONNMARK1
iptables -t mangle -A PREROUTING -m state --state NEW \
     -m statistic --mode nth --every 2 --packet 1 -j CONNMARK2


iptables -t nat -A POSTROUTING -o eth1 -j SNAT1
iptables -t nat -A POSTROUTING -o eth2 -j SNAT2

if ! cat /etc/iproute2/rt_tables | grep -q '^51'
then
    echo '51     rt_link1' >> /etc/iproute2/rt_tables
fi

if ! cat /etc/iproute2/rt_tables | grep -q '^52'
then
    echo '52     rt_link2' >> /etc/iproute2/rt_tables
fi

ip route flush table rt_link1 2>/dev/null
ip route add 172.29.13.0/24 dev eth1 src 172.29.13.201 table rt_link1
ip route add default via  172.29.13.253 table rt_link1
ip route flush table rt_link2 2>/dev/null
ip route add 172.29.14.0/24 dev eth2 src 172.29.14.201 table rt_link2
ip route add default via 172.29.14.253 table rt_link2

ip rule del from all fwmark 0x1 lookup rt_link1 2>/dev/null
ip rule del from all fwmark 0x2 lookup rt_link2 2>/dev/null
ip rule del from all fwmark 0x2 2>/dev/null
ip rule del from all fwmark 0x1 2>/dev/null

ip rule add fwmark 1 table rt_link1
ip rule add fwmark 2 table rt_link2


ip route flush cache

相关内容