求助 lvs-nat 無(wú)法訪問real-server 問題

xiaozhuang314

lvs01:
        eth0:10.78.60.6
        eth1:10.78.104.2
web01:
        eth0:10.78.60.1
        gw  : 10.78.60.6

iptables和selinux已關(guān)閉

# cat /proc/sys/net/ipv4/ip_forward
1

#ipvsadm -ln
  -> RemoteAddressort           Forward Weight ActiveConn InActConn
TCP  10.78.104.2:80 rr
  -> 10.78.60.1:80                Route   1      0          0  

# ipvsadm -lnc
IPVS connection entries
pro expire state       source             virtual            destination
TCP 00:09  SYN_RECV    10.78.104.3:37018  10.78.104.2:80     10.78.60.1:80

# wget http://10.78.104.2/index.html
--2013-05-13 14:09:42--  http://10.78.104.2/index.html
Connecting to 10.78.104.2:80... failed: Connection refused.

wenhq

web進(jìn)程起來(lái)了么？怎么會(huì)拒絕連接呢？ 你tcpdump抓下包看下。

xiaozhuang314

回復(fù) 2# wenhq

web01 上
# lsof -i:80
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
httpd   13431   root    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13433 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13434 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13435 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13436 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13437 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13438 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13439 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)
httpd   13440 apache    3u  IPv6 613564      0t0  TCP *:http (LISTEN)


#tcpdump -i eth0
17:23:33.113119 IP lvs01.45325 > web01.ssh: . ack 1379936 win 3071 <nop,nop,timestamp 199270597 1132443>
17:23:33.113166 IP web01.ssh > lvs01.45325: P 1379936:1380096(160) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>
17:23:33.113335 IP web01.ssh > lvs01.45325: P 1380096:1380368(272) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>
17:23:33.113422 IP web01.ssh > lvs01.45325: P 1380368:1380528(160) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>
17:23:33.113507 IP web01.ssh > lvs01.45325: P 1380528:1380688(160) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>
17:23:33.113588 IP web01.ssh > lvs01.45325: P 1380688:1380848(160) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>
17:23:33.113676 IP web01.ssh > lvs01.45325: P 1380848:1381008(160) ack 97 win 112 <nop,nop,timestamp 1132483 199270597>



lvs01上
#tcpdump -i eth0
17:25:01.051652 IP 10.78.104.3.42570 > 10.78.104.2.http: S 3011926969:3011926969(0) win 5840 <mss 1460,sackOK,timestamp 2880533746 0,nop,wscale 7>
17:25:01.051654 IP 10.78.104.3.42570 > 10.78.104.2.http: S 3011926969:3011926969(0) win 5840 <mss 1460,sackOK,timestamp 2880533746 0,nop,wscale 7>
17:25:01.051743 IP cl01 > 10.78.104.3: ICMP time exceeded in-transit, length 68
17:25:01.219235 IP cl01.39382 > lvs01.mysql: S 523539266:523539266(0) win 5840 <mss 1460,sackOK,timestamp 1221071 0,nop,wscale 7>


#tcpdump -i eth1
17:26:50.654913 IP 10.78.104.2.ssh > 123.122.126.151.funk-license: P 41796:41944(14 ack 157 win 319
17:26:50.654982 IP 10.78.104.2.ssh > 123.122.126.151.funk-license: P 41944:42188(244) ack 157 win 319
17:26:50.655015 IP 10.78.104.2.ssh > 123.122.126.151.funk-license: P 42188:42336(14 ack 157 win 319
17:26:50.670190 IP 123.122.126.151.funk-license > 10.78.104.2.ssh: P 157:209(52) ack 30112 win 65359
17:26:50.670203 IP 10.78.104.2.ssh > 123.122.126.151.funk-license: P 42336:42484(14 ack 209 win 319

xiaozhuang314

回復(fù) 3# xiaozhuang314


    10.78.104.3 是lvs02的ip  ，我把ha關(guān)了 現(xiàn)在只是做單機(jī)lvs轉(zhuǎn)發(fā)  不知道為啥 老跳出這ip來(lái)

wenhq

http://michaelkang.blog.51cto.com/1553154/816292

看下這個(gè)帖子。感覺配置有問題。

web tcpdump -i eth0 and host  10.78.104.2
  LVS  tcpdump -i eth1 and host  client host
         tcpdump -i eth1 and host  realserverIP

xiaozhuang314

回復(fù) 5# wenhq


    配置沒問題啊 我在另一套系統(tǒng)上做就沒出問題.
會(huì)不會(huì)是版本問題啊
系統(tǒng)是centos5.7      內(nèi)核版本  2.6.18-308.el5
IP Virtual Server version 1.2.1

#ipvsadm -lnc   
IPVS connection entries
pro expire         state       source                       virtual            destination
TCP 00:59  SYN_RECV    218.22.146.6:13803 10.78.104.2:80     10.78.60.1:80
TCP 00:58  SYN_RECV    123.130.213.105:18002 10.78.104.2:80     10.78.60.1:80
TCP 00:57  SYN_RECV    122.13.163.12:55841 10.78.104.2:80     10.78.60.1:80
TCP 00:58  SYN_RECV    173.73.146.247:2002 10.78.104.1:80     10.78.60.1:80
TCP 00:55  SYN_RECV    124.234.115.241:50686 10.78.104.2:80     10.78.60.1:80

xiaozhuang314

web01
# tcpdump -i eth0 dst host 10.78.104.2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

0 packets captured
0 packets received by filter
0 packets dropped by kernel

[root@lvs01 ~]# tcpdump -i eth1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
00:02:59.430689 IP 10.78.104.2.ssh > 103.8.221.186.6572: P 2639611540:2639611736(196) ack 2268291680 win 239

1 packets captured
44 packets received by filter
0 packets dropped by kernel

wenhq

web01 沒有給LVS回包。怎么會(huì)這樣？
tcpdump 加-v參數(shù)試試。

另外參看另一個(gè)好的LVS，測(cè)試下�？茨切┑胤接胁灰粯印�

xiaozhuang314

回復(fù) 8# wenhq


    通了  謝謝啦  是內(nèi)核版本的問題 沒用一個(gè)
#rpm -qa|grep kernel
kernel-devel-2.6.18-308.13.1.el5
kernel-2.6.18-308.13.1.el5

#modinfo ip_vs              
filename:       /lib/modules/2.6.18-164.el5/kernel/net/ipv4/ipvs/ip_vs.ko
license:        GPL
srcversion:     A2B5E0B1A2A75A935EB9015
depends:        
vermagic:       2.6.18-164.el5 SMP mod_unload 686 REGPARM 4KSTACKS gcc-4.1
module_sig:     883f3504a9f7847581431131ff6a527112e14309f57245338c32ee35367dfbdc7cc35dd9bd8ad7a609f57124478e46d98b01178e7dff8cae1a6fb59f

wenhq

呵呵，那就好。恭喜你�。�