﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>BlogJava-不急不徐，持之以恒。-随笔分类-Linux</title><link>http://www.blogjava.net/linli/category/54310.html</link><description>http://blog.gopersist.com/</description><language>zh-cn</language><lastBuildDate>Mon, 20 Apr 2015 23:37:05 GMT</lastBuildDate><pubDate>Mon, 20 Apr 2015 23:37:05 GMT</pubDate><ttl>60</ttl><item><title>Node.js的异步I/O</title><link>http://www.blogjava.net/linli/archive/2015/04/13/424380.html</link><dc:creator>老林</dc:creator><author>老林</author><pubDate>Mon, 13 Apr 2015 13:42:00 GMT</pubDate><guid>http://www.blogjava.net/linli/archive/2015/04/13/424380.html</guid><wfw:comment>http://www.blogjava.net/linli/comments/424380.html</wfw:comment><comments>http://www.blogjava.net/linli/archive/2015/04/13/424380.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.blogjava.net/linli/comments/commentRss/424380.html</wfw:commentRss><trackback:ping>http://www.blogjava.net/linli/services/trackbacks/424380.html</trackback:ping><description><![CDATA[<h2>Linux操作系统的I/O模型</h2><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">JAVA的NIO引入了异步I/O，而Node.js宣称的就是异步编程，I/O自然是异步的。其实操作系统在很早就引入了异步I/O的概念，如下图（摘自Unix网络编程中的图片）：</p><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;"><img src="http://blog.gopersist.com/images/io-node/linux-io-model.jpg" alt="" style="max-width: 100%; vertical-align: middle;" /></p><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">我对上图的理解有几点：</p><ol style="margin: 0px 0px 15px 30px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;"><li>从IO设备读取数据到用户内存的整个过程都是由系统内核来完成；</li><li>数据总是先被拷贝到内核缓冲区，再由内核缓冲区拷贝到用户内存；</li><li>除了异步I/O，其余4种I/O模型其实都是阻塞的，至少在数据从内核拷贝到用户内存时是阻塞的；</li><li>虽然异步I/O看上去是理想解决方案，但实现上现在用得最多的应该是多路I/O复用，有select、poll、epoll的实现，性能最好的是epoll；</li><li>异步I/O现在被认为有缺陷，仅支持O_DIRECT而无法支持系统缓存。</li></ol><h2>Node.js中的异步I/O</h2><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">因为内核中的异步I/O有缺陷，现实中的异步I/O通常由用户态的线程池模拟完成，如下图：</p><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;"><img src="http://blog.gopersist.com/images/io-node/node-aio.png" alt="" style="max-width: 100%; vertical-align: middle;" /></p><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">Node.js中原本使用了libeio异步I/O库，在v0.9.3后改为自己实现的线程池来完成异步I/O。所以在Node.js中，除了用户的Javascript代码是单线程外，所有I/O都是多线程并行执行的。</p><h2>Node.js中的异步I/O调用</h2><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">Node.js通过事件循环的模式运行，在每一个循环的过程中，通过询问一个或多个观察者来判断是否有事件要处理，而观察者可以有文件I/O观察者、网络I/O观察者等。</p><p style="margin: 0px 0px 15px; padding: 0px; color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">Node.js中异步I/O调用的大致流程如下：</p><ul style="margin: 0px 0px 15px 30px; padding: 0px; background-color: #fdfdfd;"><li style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px;"><em>发起I/O调用</em><ol style="margin: 0px 0px 0px 30px; padding: 0px;"><li>用户通过Javascript代码调用Node核心模块，将参数和回调函数传入到核心模块；</li><li>Node核心模块会将传入的参数和回调函数封装成一个请求对象；</li><li>将这个请求对象推入到I/O线程池等待执行；</li><li>Javascript发起的异步调用结束，Javascript线程继续执行后续操作。</li></ol></li><li><em style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px;">执行回调</em><ol style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; margin: 0px 0px 0px 30px; padding: 0px;"><li>I/O操作完成后，会将结果储存到请求对象的result属性上，并发出操作完成的通知；</li><li>每次事件循环时会检查是否有完成的I/O操作，如果有就将请求对象加入到I/O观察者队列中，之后当做事件处理；</li></ol><ul><li><font color="#111111" face="Helvetica, Arial, sans-serif"><span style="font-size: 16px; line-height: 24px;"><br /></span></font></li></ul></li><li style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px;">处理I/O观察者事件时，会取出之前封装在请求对象中的回调函数，执行这个回调函数，并将result当参数，以完成Javascript回调的目的。<br /><br />微信订阅号：<img src="http://blog.gopersist.com/images/about/weixin.jpg" width="100" height="100" alt="" style="max-width: 100%; vertical-align: middle;" /><br />源文地址：<a href="http://blog.gopersist.com" title="作者博客：http://blog.gopersist.com"><div style="display: inline !important;">http://blog.gopersist.com/2015/03/09/aio/</div></a></li></ul><img src ="http://www.blogjava.net/linli/aggbug/424380.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.blogjava.net/linli/" target="_blank">老林</a> 2015-04-13 21:42 <a href="http://www.blogjava.net/linli/archive/2015/04/13/424380.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>Linux Keepalived 实现双机热备</title><link>http://www.blogjava.net/linli/archive/2014/09/24/418220.html</link><dc:creator>老林</dc:creator><author>老林</author><pubDate>Wed, 24 Sep 2014 03:34:00 GMT</pubDate><guid>http://www.blogjava.net/linli/archive/2014/09/24/418220.html</guid><wfw:comment>http://www.blogjava.net/linli/comments/418220.html</wfw:comment><comments>http://www.blogjava.net/linli/archive/2014/09/24/418220.html#Feedback</comments><slash:comments>2</slash:comments><wfw:commentRss>http://www.blogjava.net/linli/comments/commentRss/418220.html</wfw:commentRss><trackback:ping>http://www.blogjava.net/linli/services/trackbacks/418220.html</trackback:ping><description><![CDATA[试用Keepalived来做双机热备，服务器信息如下：<br /><table cellspacing="0" border="0"> 	<colgroup span="2" width="85"></colgroup> 	<colgroup width="113"></colgroup> 	<colgroup width="85"></colgroup> 	<tbody><tr> 		<td style="border-style: solid; border-color: #000000;" height="20" align="left"><strong>服务器</strong></td> 		<td style="border-style: solid; border-color: #000000;" align="left"><strong>操作系统</strong></td> 		<td style="border-style: solid; border-color: #000000;" align="left"><strong>IP</strong></td> 		<td style="border-style: solid; border-color: #000000;" align="left"><strong>虚拟IP</strong></td> 	</tr> 	<tr> 		<td style="border-style: solid; border-color: #000000;" height="17" align="left"><strong>Server 1</strong></td> 		<td style="border-style: solid; border-color: #000000;" align="left">Centos</td> 		<td style="border-style: solid; border-color: #000000;" align="left">192.168.18.20</td> 		<td style="border-style: solid; border-color: #000000;" align="left">192.168.18.22</td> 	</tr> 	<tr> 		<td style="border-style: solid; border-color: #000000;" height="17" align="left"><strong>Server 2</strong></td> 		<td style="border-style: solid; border-color: #000000;" align="left">Centos</td> 		<td style="border-style: solid; border-color: #000000;" align="left">192.168.18.21</td> 		<td style="border-style: solid; border-color: #000000;" align="left">192.168.18.22</td> 	</tr></tbody></table><h4>1. 安装Keepalived</h4>2台Server都使用下面的命令安装Keepalived：<br /><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all">yum&nbsp;install&nbsp;keepalived&nbsp;-y</div><h4>2. Server1 Keepalived 配置</h4><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->$&nbsp;vi&nbsp;/etc/keepalived/keepalived.conf<br /><br />vrrp_instance&nbsp;VI_1&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;state MASTER<br />&nbsp;&nbsp;&nbsp;&nbsp;interface&nbsp;eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;virtual_router_id&nbsp;51<br />&nbsp;&nbsp;&nbsp;&nbsp;priority 100 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #&nbsp;优先级<br />&nbsp;&nbsp;&nbsp;&nbsp;advert_int&nbsp;1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;心跳间隔(秒)<br />&nbsp;&nbsp;&nbsp;&nbsp;authentication&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_type&nbsp;PASS<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_pass&nbsp;1111<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;virtual_ipaddress&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;192.168.18.22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;虚拟IP<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />}</div><h4>3. Server2 Keepalived 配置</h4><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all">$&nbsp;vi&nbsp;/etc/keepalived/keepalived.conf<br /><br />vrrp_instance&nbsp;VI_1&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;state&nbsp;BACKUP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;备份机<br />&nbsp;&nbsp;&nbsp;&nbsp;<span>interface</span><span>&nbsp;</span>eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;virtual_router_id&nbsp;51<br />&nbsp;&nbsp;&nbsp;&nbsp;priority&nbsp;99&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;优先级，比主服务器底<br />&nbsp;&nbsp;&nbsp;&nbsp;advert_int&nbsp;1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;心跳间隔(秒)<br />&nbsp;&nbsp;&nbsp;&nbsp;authentication&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_type&nbsp;PASS<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_pass&nbsp;1111<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />&nbsp;&nbsp;&nbsp;&nbsp;virtual_ipaddress&nbsp;{<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;192.168.18.22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;虚拟IP<br />&nbsp;&nbsp;&nbsp;&nbsp;}<br />}</div><h4>4. 启动Keepalived</h4><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->$&nbsp;service&nbsp;keepalived&nbsp;start</div>启动keepalived后，可看到2台Server都绑定了虚拟IP：<br /><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->$&nbsp;ip&nbsp;a<br /><br />#&nbsp;Server&nbsp;1:<br />2:&nbsp;eth0:&nbsp;&lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt;&nbsp;mtu&nbsp;1500&nbsp;qdisc&nbsp;pfifo_fast&nbsp;state&nbsp;UP&nbsp;qlen&nbsp;1000<br />&nbsp;&nbsp;&nbsp;&nbsp;link/ether&nbsp;00:24:8c:8c:67:43&nbsp;brd&nbsp;ff:ff:ff:ff:ff:ff<br />&nbsp;&nbsp;&nbsp;&nbsp;inet&nbsp;192.168.18.20/24&nbsp;brd&nbsp;192.168.18.255&nbsp;scope&nbsp;global&nbsp;eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;inet&nbsp;192.168.18.22/32&nbsp;scope&nbsp;global&nbsp;eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;inet6&nbsp;fe80::224:8cff:fe8c:6743/64&nbsp;scope&nbsp;link&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft&nbsp;forever&nbsp;preferred_lft&nbsp;forever<br /><br />#&nbsp;Server&nbsp;2:<br />2:&nbsp;eth0:&nbsp;&lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt;&nbsp;mtu&nbsp;1500&nbsp;qdisc&nbsp;pfifo_fast&nbsp;state&nbsp;UP&nbsp;qlen&nbsp;1000<br />&nbsp;&nbsp;&nbsp;&nbsp;link/ether&nbsp;00:23:54:bf:ab:17&nbsp;brd&nbsp;ff:ff:ff:ff:ff:ff<br />&nbsp;&nbsp;&nbsp;&nbsp;inet&nbsp;192.168.18.21/24&nbsp;brd&nbsp;192.168.18.255&nbsp;scope&nbsp;global&nbsp;eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;inet&nbsp;192.168.18.22/32&nbsp;scope&nbsp;global&nbsp;eth0<br />&nbsp;&nbsp;&nbsp;&nbsp;inet6&nbsp;fe80::223:54ff:febf:ab17/64&nbsp;scope&nbsp;link&nbsp;<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft&nbsp;forever&nbsp;preferred_lft&nbsp;forever</div><h4>5. 测试</h4>浏览器访问http://192.168.18.22，出现 This is Server 1.<br />将192.168.18.20关闭，再访问http://192.168.18.22，出现This is Server 2.<br /><br /><span style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">微信订阅号：</span><img src="http://blog.gopersist.com/images/about/weixin.jpg" width="100" height="100" alt="" style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; max-width: 100%; vertical-align: middle;" /><br style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px;" /><span style="color: #111111; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 24px; background-color: #fdfdfd;">源文地址：<a href="http://blog.gopersist.com/2014/09/24/keepalived/">http://blog.gopersist.com/2014/09/24/keepalived/</a></span><img src ="http://www.blogjava.net/linli/aggbug/418220.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.blogjava.net/linli/" target="_blank">老林</a> 2014-09-24 11:34 <a href="http://www.blogjava.net/linli/archive/2014/09/24/418220.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>LVS-DR</title><link>http://www.blogjava.net/linli/archive/2014/04/28/413001.html</link><dc:creator>老林</dc:creator><author>老林</author><pubDate>Mon, 28 Apr 2014 03:15:00 GMT</pubDate><guid>http://www.blogjava.net/linli/archive/2014/04/28/413001.html</guid><wfw:comment>http://www.blogjava.net/linli/comments/413001.html</wfw:comment><comments>http://www.blogjava.net/linli/archive/2014/04/28/413001.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.blogjava.net/linli/comments/commentRss/413001.html</wfw:commentRss><trackback:ping>http://www.blogjava.net/linli/services/trackbacks/413001.html</trackback:ping><description><![CDATA[<p><span style="font-family:宋体;">试用</span>IPVS<span style="font-family:宋体;">的直接路由方式来做负载均衡。服务器信息如下：</span></p>
<p><img src="http://www.blogjava.net/images/blogjava_net/linli/linux/LVS-DR.png" width="430" height="382" alt="" /><br />
</p>
<p>&nbsp;</p>
<p>IP<span style="font-family:宋体;">配置信息如下：</span></p>
<table border="1" cellspacing="0" cellpadding="0" style="border-collapse: collapse; border: none;">
     <tbody>
         <tr>
             <td width="92" valign="top" style="width: 69.15pt; border-style: solid; border-color: #999999 #999999 #666666; border-width: 1pt 1pt 1.5pt; padding: 0cm 5.4pt;">
             <p><strong><span style="font-family:宋体;">服务器</span></strong></p>
             </td>
             <td width="101" valign="top" style="width:75.55pt;border-top:solid #999999 1.0pt;border-left: none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p><strong><span style="font-family:宋体;">操作系统</span></strong></p>
             </td>
             <td width="137" valign="top" style="width:102.95pt;border-top:solid #999999 1.0pt;border-left: none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p><strong>IP</strong></p>
             </td>
             <td width="124" valign="top" style="width:92.95pt;border-top:solid #999999 1.0pt;border-left: none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p><strong>IP</strong><strong><span style="font-family:宋体;">别名</span></strong></p>
             </td>
             <td width="99" valign="top" style="width:74.2pt;border-top:solid #999999 1.0pt;border-left: none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p><strong><span style="font-family:宋体;">网关</span></strong></p>
             </td>
         </tr>
         <tr>
             <td width="92" style="width: 69.15pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">
             <p><strong><span style="font-family:宋体;">调度服务器</span></strong></p>
             </td>
             <td width="101" style="width:75.55pt;border-top:none;border-left:none; border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>Centos</p>
             </td>
             <td width="137" valign="top" style="width:102.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.90</p>
             </td>
             <td width="124" valign="top" style="width:92.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.99</p>
             </td>
             <td width="99" valign="top" style="width:74.2pt;border-top:none;border-left:none; border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.1</p>
             </td>
         </tr>
         <tr>
             <td width="92" rowspan="2" style="width: 69.15pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">
             <p><strong><span style="font-family:宋体;">实际服务器</span></strong></p>
             </td>
             <td width="101" valign="top" style="width:75.55pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>Centos</p>
             </td>
             <td width="137" valign="top" style="width:102.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.71</p>
             </td>
             <td width="124" valign="top" style="width:92.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.99</p>
             </td>
             <td width="99" valign="top" style="width:74.2pt;border-top:none;border-left:none; border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.1</p>
             </td>
         </tr>
         <tr>
             <td width="101" valign="top" style="width:75.55pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>Centos</p>
             </td>
             <td width="137" valign="top" style="width:102.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.72</p>
             </td>
             <td width="124" valign="top" style="width:92.95pt;border-top:none;border-left: none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.99</p>
             </td>
             <td width="99" valign="top" style="width:74.2pt;border-top:none;border-left:none; border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
             <p>192.168.2.1</p>
             </td>
         </tr>
     </tbody>
</table>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">直接路由方式工作在数据链路层，通过修改数据包的</span>MAC<span style="font-family:宋体;">地址，将数据包转发到实际服务器上。实际服务器响应时直接发送给用户端，而不经过调度器。</span></p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">因为调度服务器并没有修改数据包的</span>IP<span style="font-family:宋体;">地址，所以我们需要为实际服务器设置与调度服务器相同的</span>IP<span style="font-family:宋体;">别名，以使实际服务器接受数据包。</span></p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">为调度服务器设置</span>IP<span style="font-family:宋体;">别名：</span></p>
<p>ifconfig eth1:0 192.168.2.99</p>
<p>IP<span style="font-family:宋体;">别名与原来的</span>IP<span style="font-family:宋体;">地址在使用上并没有什么不同，这里可以</span>ping<span style="font-family:宋体;">通</span>90<span style="font-family:宋体;">和</span>99<span style="font-family:宋体;">两个</span>IP<span style="font-family:宋体;">。</span></p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">为实际服务器设置</span>IP<span style="font-family:宋体;">别名：</span></p>
<p>ifconfig lo:0 192.168.2.99 broadcast 192.168.2.99 netmask 255.255.255.255 up</p>
<p><span style="font-family:宋体;">为实际服务器添加路由规则，使它不去寻找其他拥有这个</span>IP<span style="font-family:宋体;">的服务器：</span></p>
<p>route add -host 192.168.2.99 dev lo:0</p>
<p><span style="font-family:宋体;">防止实际服务器响应针对</span>IP<span style="font-family:宋体;">别名的</span>ARP<span style="font-family:宋体;">广播：</span></p>
<p>echo 1&gt;/proc/sys/net/ipv4/conf/lo/arp_ignore</p>
<p>echo 2&gt;/proc/sys/net/ipv4/conf/lo/arp_announce</p>
<p>echo 1&gt;/proc/sys/net/ipv4/conf/all/arp_ignore</p>
<p>echo 2&gt;/proc/sys/net/ipv4/conf/all/arp_announce</p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">使用</span>ipvsadm<span style="font-family:宋体;">配置调度服务器：</span></p>
<p>ipvsadm -A -t 192.168.2.99:8888 -s rr</p>
<p>ipvsadm -a -t 192.168.2.99:8888 -r 192.168.2.71:8888 -g</p>
<p>ipvsadm -a -t 192.168.2.99:8888 -r 192.168.2.72:8888 -g</p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">使用下面的命令将连接有效时间改为</span>1<span style="font-family:宋体;">秒来测试，：</span></p>
<p>ipvsadm --set 1 120 300</p>
<p>&nbsp;</p>
<p><span style="font-family:宋体;">浏览器访问</span>http://192.168.2.99:8888<span style="font-family:宋体;">，每隔</span>1<span style="font-family:宋体;">秒多点击刷新，就会交替出现</span>192.168.2.71<span style="font-family:宋体;">和</span>192.168.2.72<span style="font-family:宋体;">。</span></p>
<p>&nbsp;</p><img src ="http://www.blogjava.net/linli/aggbug/413001.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.blogjava.net/linli/" target="_blank">老林</a> 2014-04-28 11:15 <a href="http://www.blogjava.net/linli/archive/2014/04/28/413001.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>LVS-NAT</title><link>http://www.blogjava.net/linli/archive/2014/04/25/412933.html</link><dc:creator>老林</dc:creator><author>老林</author><pubDate>Fri, 25 Apr 2014 06:32:00 GMT</pubDate><guid>http://www.blogjava.net/linli/archive/2014/04/25/412933.html</guid><wfw:comment>http://www.blogjava.net/linli/comments/412933.html</wfw:comment><comments>http://www.blogjava.net/linli/archive/2014/04/25/412933.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.blogjava.net/linli/comments/commentRss/412933.html</wfw:commentRss><trackback:ping>http://www.blogjava.net/linli/services/trackbacks/412933.html</trackback:ping><description><![CDATA[<p><span style="font-family:宋体;">试用</span>IPVS<span style="font-family:宋体;">来做负载均衡，使用了</span>1<span style="font-family:宋体;">台双网卡服务器和</span>2<span style="font-family:宋体;">台单网卡服务器，</span>2<span style="font-family:宋体;">个网段。服务器信息如下：</span></p>  <p><img src="http://www.blogjava.net/images/blogjava_net/linli/linux/LVS-NAT.png" width="846" height="393" alt="" /><br /></p>  <p><br /></p>  <p>IP<span style="font-family:宋体;">配置信息如下：</span></p>  <table border="1" cellspacing="0" cellpadding="0" style="border-collapse: collapse; border: none;">  <tbody><tr>   <td width="132" valign="top" style="width: 99.05pt; border-style: solid; border-color: #999999 #999999 #666666; border-width: 1pt 1pt 1.5pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">服务器</span></strong></p>   </td>   <td width="128" valign="top" style="width:95.7pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong><span style="font-family:宋体;">操作系统</span></strong></p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong><span style="font-family:宋体;">网卡</span></strong></p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong>IP</strong></p>   </td>  </tr>  <tr>   <td width="132" rowspan="2" style="width: 99.05pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">调度服务器</span></strong></p>   </td>   <td width="128" rowspan="2" style="width:95.7pt;border-top:none;border-left:none;   border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>Centos</p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth0</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.18.58</p>   </td>  </tr>  <tr>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth1</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.2.90</p>   </td>  </tr>  <tr>   <td width="132" rowspan="2" style="width: 99.05pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">实际服务器</span></strong></p>   </td>   <td width="128" valign="top" style="width:95.7pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>Centos</p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth0</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.2.71</p>   </td>  </tr>  <tr>   <td width="128" valign="top" style="width:95.7pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>Centos</p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth0</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.2.72</p>   </td>  </tr> </tbody></table>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;"><strong>1.<span style="font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong><strong><span style="font-family:宋体;">首先配置调度服务器：</span></strong></p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">a)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>IPVS<span style="font-family:宋体;">模块已经内置到</span>linux2.6.x<span style="font-family:宋体;">内核中，可以通过下面的命令查看是否已安装：</span></p>  <p>modprobe -l | grep ipvs</p>  <p><span style="font-family:宋体;">看到类似下面的输出，表示已经安装了</span></p>  <p>kernel/net/netfilter/ipvs/ip_vs.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_rr.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_wrr.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_lc.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_wlc.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_lblc.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_lblcr.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_dh.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_sh.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_sed.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_nq.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_ftp.ko</p>  <p>kernel/net/netfilter/ipvs/ip_vs_pe_sip.ko</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">b)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">安装</span>IPVS<span style="font-family:宋体;">的管理工具</span>ipvsadm<span style="font-family:宋体;">：</span></p>  <p>yum install -y ipvsadm</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">c)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">清除表中所有记录：</span></p>  <p>ipvsadm -C</p>  <p><span style="font-family:宋体;">使用下面的命令增加虚拟服务器，采用轮询调度策略：</span></p>  <p>ipvsadm -A -t 192.168.18.58:8888 -s rr</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">使用下面的命令添加实际服务器，并采用</span>NAT<span style="font-family:宋体;">方式转发数据包：</span></p>  <p>ipvsadm -a -t 192.168.18.58:8888 -r 192.168.2.71:9999 -m</p>  <p>ipvsadm -a -t 192.168.18.58:8888 -r 192.168.2.72:9999 -m</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">d)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">打开数据包转发：</span></p>  <p>echo 1 &gt; /proc/sys/net/ipv4/ip_forward</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;"><strong>2.<span style="font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong><strong><span style="font-family:宋体;">接下来配置</span>2</strong><strong><span style="font-family:宋体;">台实际服务器，分别做以下工作：</span></strong></p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">a)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">在</span>9999<span style="font-family:宋体;">端口上启动一个</span>web<span style="font-family:宋体;">服务：</span></p>  <p><span style="font-family:宋体;">配置好</span>web<span style="font-family:宋体;">服务后，当访问</span>http://192.168.2.71:9999<span style="font-family:宋体;">时，页面返回：</span>This is 192.168.2.71.<span style="font-family:宋体;">；当访问</span>http://192.168.2.72:9999<span style="font-family:宋体;">时，页面返回：</span>This is 192.168.2.72.</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;">b)<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">设置默认网关指向调度服务器</span></p>  <p>route del default</p>  <p>route add default gw 192.168.2.90</p>  <p>&nbsp;</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;"><strong>3.<span style="font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong><strong><span style="font-family:宋体;">测试</span></strong></p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">访问</span>192.168.18.58:8888<span style="font-family:宋体;">，会显示</span>This is 192.168.2.71<span style="font-family:宋体;">或</span>This is 192.168.2.72<span style="font-family:宋体;">，多次刷新应该要交替出现</span>71<span style="font-family:宋体;">和</span>72<span style="font-family:宋体;">，但实际上并没有这样，浏览器只显示与第一次相同的内容，也就是</span>ipvsadm<span style="font-family:宋体;">每次都选择了同一台服务器。这是因为当一个</span>TCP<span style="font-family:宋体;">连接的初始</span>SYN<span style="font-family:宋体;">报文到达时，</span>IPVS<span style="font-family:宋体;">就选择了一台服务器，后继报文会被转发到相同的服务器。这个</span>TCP<span style="font-family:宋体;">连接在</span>ipvsadm<span style="font-family:宋体;">中默认有效时间为</span>15<span style="font-family:宋体;">分钟，可以通过下面的命令查看：</span></p>  <p>ipvsadm -L --timeout</p>  <p>Timeout (tcp tcpfin udp): 900 120 300</p>  <p><span style="font-family:宋体;">现在将有效时间改为</span>1<span style="font-family:宋体;">秒来测试，使用下面的命令：</span></p>  <p>ipvsadm --set 1 120 300</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">再到浏览器中每隔</span>1<span style="font-family:宋体;">秒多点击刷新，就会交替出现</span>71<span style="font-family:宋体;">和</span>72<span style="font-family:宋体;">，说明轮询调度正在正常工作。</span></p>  <p>&nbsp;</p>  <p>&nbsp;</p><img src ="http://www.blogjava.net/linli/aggbug/412933.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.blogjava.net/linli/" target="_blank">老林</a> 2014-04-25 14:32 <a href="http://www.blogjava.net/linli/archive/2014/04/25/412933.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>iptables NAT 学习</title><link>http://www.blogjava.net/linli/archive/2014/04/24/412896.html</link><dc:creator>老林</dc:creator><author>老林</author><pubDate>Thu, 24 Apr 2014 09:15:00 GMT</pubDate><guid>http://www.blogjava.net/linli/archive/2014/04/24/412896.html</guid><wfw:comment>http://www.blogjava.net/linli/comments/412896.html</wfw:comment><comments>http://www.blogjava.net/linli/archive/2014/04/24/412896.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.blogjava.net/linli/comments/commentRss/412896.html</wfw:commentRss><trackback:ping>http://www.blogjava.net/linli/services/trackbacks/412896.html</trackback:ping><description><![CDATA[<p class="MsoNormal"><span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin">为了搞清楚</span><span lang="EN-US">iptables NAT</span><span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin">的过程，做了这个实验。使用了</span><span lang="EN-US">1</span><span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin">台双网卡服务器和</span><span lang="EN-US">1</span><span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin">台单网卡服务器，</span><span lang="EN-US">2</span><span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin">个网段。服务器信息如下：</span></p><p><img src="http://www.blogjava.net/images/blogjava_net/linli/iptables-1.png" border="0" alt="" width="841" height="156" /><br /></p>  <p>IP<span style="font-family:宋体;">配置信息如下：</span></p>  <table border="1" cellspacing="0" cellpadding="0" style="border-collapse: collapse; border: none;">  <tbody><tr>   <td width="132" valign="top" style="width: 99.05pt; border-style: solid; border-color: #999999 #999999 #666666; border-width: 1pt 1pt 1.5pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">服务器</span></strong></p>   </td>   <td width="128" valign="top" style="width:95.7pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong><span style="font-family:宋体;">操作系统</span></strong></p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong><span style="font-family:宋体;">网卡</span></strong></p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:solid #999999 1.0pt;border-left:   none;border-bottom:solid #666666 1.5pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p><strong>IP</strong></p>   </td>  </tr>  <tr>   <td width="132" rowspan="2" style="width: 99.05pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">调度服务器</span></strong></p>   </td>   <td width="128" rowspan="2" style="width:95.7pt;border-top:none;border-left:none;   border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>Centos</p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth0</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.18.58</p>   </td>  </tr>  <tr>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth1</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.2.90</p>   </td>  </tr>  <tr>   <td width="132" valign="top" style="width: 99.05pt; border-style: none solid solid; border-right-color: #999999; border-bottom-color: #999999; border-left-color: #999999; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding: 0cm 5.4pt;">   <p><strong><span style="font-family:宋体;">实际服务器</span></strong></p>   </td>   <td width="128" valign="top" style="width:95.7pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>Centos</p>   </td>   <td width="136" valign="top" style="width:102.15pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>eth0</p>   </td>   <td width="157" valign="top" style="width:117.9pt;border-top:none;border-left:   none;border-bottom:solid #999999 1.0pt;border-right:solid #999999 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">   <p>192.168.2.73</p>   </td>  </tr> </tbody></table>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">1.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">为了看到调度服务器上的数据转发过程，首先在调度服务器上分出</span>内核的debug<span style="font-family:宋体;">日志：</span></p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;"><span style="font-family:Wingdings;">l&nbsp;</span><span style="font-family:宋体;">在</span>/etc/rsyslog.conf<span style="font-family:宋体;">最后增加：</span>kern.debug /var/log/iptables.log</p>  <p style="margin-left:21.0pt;text-indent:-21.0pt;"><span style="font-family:Wingdings;">l&nbsp;</span><span style="font-family:宋体;">重启日志服务：</span>/etc/init.d/rsyslog restart</p>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">2.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">启动调度服务器的</span>iptables<span style="font-family:宋体;">并清空规则</span></p>  <p>service iptables start</p>  <p>iptables -F</p>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">3.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">增加调度服务器的</span>iptables<span style="font-family:宋体;">特定日志输出</span></p>  <p><span style="font-family:宋体;">假设要将对调度服务器</span>8888<span style="font-family:宋体;">端口的访问转发给实际服务器的</span>9999<span style="font-family:宋体;">端口处理，在</span>iptables<span style="font-family:宋体;">中增加与这</span>2<span style="font-family:宋体;">个端口相关的日志输出：</span></p>  <p>iptables -t mangle -A PREROUTING -p tcp --dport 8888 -j LOG --log-level debug --log-prefix "&lt;&lt;&lt;&lt;&lt; PER IN:"</p>  <p>iptables -t mangle -A PREROUTING -p tcp --sport 9999 -j LOG --log-level debug --log-prefix "&lt;&lt;&lt;&lt;&lt; PER IN:"</p>  <p>iptables -t mangle -A POSTROUTING -p tcp --sport 8888 -j LOG --log-level debug --log-prefix "&gt;&gt;&gt;&gt;&gt; POST OUT:"</p>  <p>iptables -t mangle -A POSTROUTING -p tcp --dport 9999 -j LOG --log-level debug --log-prefix "&gt;&gt;&gt;&gt;&gt; POST OUT:"</p>  <p>iptables -t mangle -A POSTROUTING -p tcp --sport 9999 -j LOG --log-level debug --log-prefix "&gt;&gt;&gt;&gt;&gt; POST OUT:"</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">这时，通过浏览器访问</span>http://192.168.18.58:8888<span style="font-family:宋体;">可以看到</span>iptables.log<span style="font-family:宋体;">中打印出下面的日志：</span></p>  <p>Apr 24 16:24:35 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; PER IN:<span style="color:red">IN=eth0</span> OUT= MAC=00:1f:c6:cb:eb:e0:00:1f:33:de:29:ad:08:00 SRC=192.168.18.25 DST=192.168.18.58 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=28721 DF PROTO=TCP SPT=50270 <span style="color:red">DPT=8888</span> WINDOW=14600 RES=0x00 SYN URGP=0 </p>  <p>Apr 24 16:24:35 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; POST OUT:IN= <span style="color:red">OUT=eth0</span> SRC=192.168.18.58 DST=192.168.18.25 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP <span style="color:red">SPT=8888</span> DPT=50270 WINDOW=0 RES=0x00 ACK RST URGP=0</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">虽然这个端口上即没有应用，也没有将请求转发出去，但日志打印出了内核获取到的对这个端口的请求。</span></p>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">4.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">配置</span>iptables<span style="font-family:宋体;">将对</span>8888<span style="font-family:宋体;">的请求转发到</span>192.168.2.73:9999</p>  <p>iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8888 -j DNAT --to-destination 192.168.2.73:9999</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">访问</span>http://192.168.18.58:8888<span style="font-family:宋体;">，日志中打印如下信息：</span></p>  <p>Apr 24 16:39:21 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; PER IN:<span style="color:red">IN=eth0</span> OUT= MAC=00:1f:c6:cb:eb:e0:00:1f:33:de:29:ad:08:00 SRC=192.168.18.25 <span style="color:red">DST=192.168.18.58</span> LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=56888 DF PROTO=TCP SPT=50274 <span style="color:red">DPT=8888</span> WINDOW=14600 RES=0x00 SYN URGP=0 </p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">日志中只打印了从</span>eth0<span style="font-family:宋体;">收到的对</span>8888<span style="font-family:宋体;">端口的请求，这是因为当数据要被转发到</span>192.168.2.73:9999<span style="font-family:宋体;">时，默认情况下被禁止了。</span></p>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">5.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">打开数据包转发功能</span></p>  <p>echo 1 &gt; /proc/sys/net/ipv4/ip_forward</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">访问</span>http://192.168.18.58:8888<span style="font-family:宋体;">，日志中打印如下信息：</span></p>  <p>Apr 24 16:39:21 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; PER IN:<span style="color:red">IN=eth0</span> OUT= MAC=00:1f:c6:cb:eb:e0:00:1f:33:de:29:ad:08:00 SRC=192.168.18.25 <span style="color:red">DST=192.168.18.58</span> LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=56888 DF PROTO=TCP SPT=50274 <span style="color:red">DPT=8888</span> WINDOW=14600 RES=0x00 SYN URGP=0 </p>  <p>Apr 24 16:39:21 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; POST OUT:IN= <span style="color:red">OUT=eth1</span> SRC=192.168.18.25 <span style="color:red">DST=192.168.2.73</span> LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=56888 DF PROTO=TCP SPT=50274 <span style="color:red">DPT=9999</span> WINDOW=14600 RES=0x00 SYN URGP=0</p>  <p>&nbsp;</p>  <p><span style="font-family: 宋体;">第一条日志显示从</span>eth0<span style="font-family:宋体;">收到了对</span>8888<span style="font-family:宋体;">端口的请求，第二条日志显示</span>iptables<span style="font-family:宋体;">已经更改了数据包的目的地为</span>192.168.2.73:9999<span style="font-family:宋体;">，并通过</span>eth1<span style="font-family:宋体;">发出去。</span></p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">但这时请求虽然已经被转发到实际处理的服务器，但调度服务器收不到响应，浏览器仍在不停重试，日志也在不断打印。这是因为实际服务器收到的数据包的来源</span>IP<span style="font-family:宋体;">是另一个网段的，实际服务器回复时，发现不是本网段的就把数据包发给网关，网关设置的是</span>192.168.2.1<span style="font-family:宋体;">，这时数据就丢了。</span></p>  <p>&nbsp;</p>  <p style="margin-left:18.0pt;text-indent:-18.0pt;">6.<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span style="font-family:宋体;">将实际服务器的默认网关设置为</span>192.168.2.90</p>  <p><span style="font-family:宋体;">在实际服务器上执行以下命令：</span></p>  <p>route del default</p>  <p>route add default gw 192.168.2.90</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">再次访问</span>http://192.168.18.58:8888<span style="font-family:宋体;">，日志打印如下信息：</span></p>  <p>Apr 24 16:47:27 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; PER IN:<span style="color:red">IN=eth0</span> OUT= MAC=00:1f:c6:cb:eb:e0:00:1f:33:de:29:ad:08:00 SRC=192.168.18.25 <span style="color:red">DST=192.168.18.58</span> LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=37000 DF PROTO=TCP SPT=50279 <span style="color:red">DPT=8888</span> WINDOW=14600 RES=0x00 SYN URGP=0 </p>  <p>Apr 24 16:47:27 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; POST OUT:IN= <span style="color:red">OUT=eth1</span> SRC=192.168.18.25 <span style="color:red">DST=192.168.2.73</span> LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=37000 DF PROTO=TCP SPT=50279 <span style="color:red">DPT=9999</span> WINDOW=14600 RES=0x00 SYN URGP=0 </p>  <p>Apr 24 16:47:27 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; PER IN:<span style="color:red">IN=eth1</span> OUT= MAC=00:22:b0:de:f7:49:00:24:8c:b4:a1:8c:08:00 <span style="color:red">SRC=192.168.2.73</span> DST=192.168.18.25 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP <span style="color:red">SPT=9999</span> DPT=50279 WINDOW=0 RES=0x00 ACK RST URGP=0 </p>  <p>Apr 24 16:47:27 route-server1 kernel: &lt;&lt;&lt;&lt;&lt; POST OUT:IN= <span style="color:red">OUT=eth0</span> SRC=192.168.2.73 DST=192.168.18.25 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=9999 DPT=50279 WINDOW=0 RES=0x00 ACK RST URGP=0</p>  <p>&nbsp;</p>  <p><span style="font-family:宋体;">上面第一条第二条日志和之前一样，</span>iptables<span style="font-family:宋体;">将目地址更改后，通过</span>eth1<span style="font-family:宋体;">网卡发送出去。第三条日志通过</span>eth1<span style="font-family:宋体;">网卡接收到了实际服务器发送过来的数据，并在第四条日志中通过</span>eth0<span style="font-family:宋体;">发回请求方。</span></p>  <p>&nbsp;</p><img src ="http://www.blogjava.net/linli/aggbug/412896.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.blogjava.net/linli/" target="_blank">老林</a> 2014-04-24 17:15 <a href="http://www.blogjava.net/linli/archive/2014/04/24/412896.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>