Хочу сделать балансировку по статье-хауту:
http://www.opennet.ru/base/net/squid_ipvs_...alived.txt.html
схема примерно такая
gw - ip провайдеров
to inet - интерфейсы на балансировшике кторые смотрят в нет
to local - интерфейсы на балансировшике кторые смотрят в локальную сеть
squid - вот это должен быть сбалансированнай канал с прокси
192.168.1.1 - встречается в логах и настройках http сервер для теста
gw to inet to local squid
192.168.10.1 192.168.10.2 192.168.100.1 192.168.100.100
192.168.20.1 192.168.20.2 192.168.100.2
Логи и настройки тут:
http://file.qip.ru/file/118335911/91fa2b26/ipvs.html
Вроде все настроил, но squid не видит виртуальный интерфейс поднимаемый keepalived (сбалансированный).
Запросы приходящие на него в лог не попадают, когда как если в качестве прокси прописать один из балансируемых интерфейсов в лог сквида они попадают и отрабатывают (в access.log с 192.168.100.200).
Подскажиет плз в чем может быть дело или куда посмотреть, что проверить или потестить.
Если нужна дополнительная инфа - добалю.
Настройки и логи привожу ниже, сорри что так много атача.
спасибо!
=====interfaces================
Код: Выделить всё
auto lo eth0 eth0:0 eth1 eth2
iface lo inet loopback
iface eth0 inet static
address 192.168.100.1
netmask 255.255.255.0
network 192.168.100.0
iface eth0:0 inet static
address 192.168.100.2
netmask 255.255.255.0
network 192.168.100.0
iface eth1 inet static
address 192.168.10.2
netmask 255.255.255.0
network 192.168.10.0
gateway 192.168.10.1
iface eth2 inet static
address 192.168.20.2
netmask 255.255.255.0
network 192.168.20.0
gateway 192.168.20.1=====resolv.conf================
Код: Выделить всё
nameserver 192.168.10.1
nameserver 192.168.20.1=====squid.conf================
Код: Выделить всё
# WELCOME TO SQUID 2.7.STABLE3
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
acl host_eth0 myip 192.168.100.1
acl host_eth00 myip 192.168.100.2
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
icp_access allow localnet
icp_access deny all
http_port 3128 transparent
tcp_outgoing_address 192.168.10.2 host_eth0
tcp_outgoing_address 192.168.20.2 host_eth00
hierarchy_stoplist cgi-bin ?
cache_dir null /tmp
access_log /var/log/squid/access.log squid
cache deny all
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Package(.gz)*)$ 0 20% 2880
refresh_pattern . 0 20% 4320
acl shoutcast rep_header X-HTTP09-First-Line ^ICY\s[0-9]
upgrade_http0.9 deny shoutcast
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
extension_methods REPORT MERGE MKACTIVITY CHECKOUT
server_persistent_connections off
hosts_file /etc/hosts
coredump_dir /var/spool/squid=====keepalived.conf================
Код: Выделить всё
global_defs {
#notification_email {
# igronin@qip.ru
#}
#notification_email_from igronin@qip.ru
#smtp_server 82.204.219.180 #smtp.qip.ru
#smtp_connect_timeout 30
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.100.100/24
}
}
virtual_server 192.168.100.100 3128 {
delay_loop 6
lb_algo rr
lb_kind NAT
nat_mask 255.255.255.0
persistence_timeout 600
protocol TCP
virtualhost 93.84.113.6
real_server 192.168.100.1 3128 {
weight 1
HTTP_GET {
url {
path [url="http://192.168.1.1"]http://192.168.1.1[/url]
status_code 200
}
connect_timeout 10
nb_get_retry 3
delay_before_retry 8
}
}
real_server 192.168.100.2 3128 {
weight 1
HTTP_GET {
url {
path [url="http://192.168.1.1"]http://192.168.1.1[/url]
status_code 200
}
connect_timeout 10
nb_get_retry 3
delay_before_retry 8
}
}
}=====rc.local================
Код: Выделить всё
#!/bin/sh -e
#
/home/igronin/ipvs/route.sh
exit 0=====route.sh================
Код: Выделить всё
#!/bin/sh
ip route add 192.168.10.0 dev eth1 src 192.168.10.2 table T1
ip route add default via 192.168.10.1 table T1
ip route add 192.168.20.0 dev eth2 src 192.168.20.2 table T2
ip route add default via 192.168.20.1 table T2
ip route add 192.168.10.0 dev eth1 src 192.168.10.2
ip route add 192.168.20.0 dev eth2 src 192.168.20.2
#ip route add default via 192.168.10.1
ip rule add from 192.168.10.2 table T1
ip rule add from 192.168.20.2 table T2
ip route add 192.168.100.0 dev eth0 table T1
ip route add 192.168.20.0 dev eth2 table T1
ip route add 127.0.0.0/8 dev lo table T1
ip route add 192.168.100.0 dev eth0 table T2
ip route add 192.168.10.0 dev eth1 table T2
ip route add 127.0.0.0/8 dev lo table T2
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128=====messages================
Код: Выделить всё
Feb 1 01:01:47 ubuntubalance Keepalived_healthcheckers: HTTP status code success to [192.168.100.1:3128] url(1).
Feb 1 01:01:47 ubuntubalance Keepalived_healthcheckers: HTTP status code success to [192.168.100.2:3128] url(1).
Feb 1 01:01:50 ubuntubalance pulseaudio[4073]: alsa-util.c: Device front:0 doesn't support 44100 Hz, changed to 44099 Hz.
Feb 1 01:01:53 ubuntubalance Keepalived_healthcheckers: Remote Web server [192.168.100.1:3128] succeed on service.
Feb 1 01:01:53 ubuntubalance Keepalived_healthcheckers: Adding service [192.168.100.1:3128] to VS [192.168.100.100:3128]
Feb 1 01:01:53 ubuntubalance Keepalived_healthcheckers: Remote Web server [192.168.100.2:3128] succeed on service.
Feb 1 01:01:53 ubuntubalance Keepalived_healthcheckers: Adding service [192.168.100.2:3128] to VS [192.168.100.100:3128]=====access.log================
Код: Выделить всё
# там где встречается 192.168.100.200, был прокси был настроен на одни из внутренних интерфейсов, а не на балансировщик
1264979138.302 362 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979152.222 363 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979152.687 382 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979166.590 364 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979167.073 385 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979175.152 394 192.168.100.200 TCP_MISS/200 5074 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979180.960 366 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979181.445 363 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979188.413 3353 192.168.100.200 TCP_MISS/200 31778 POST [url="http://192.168.1.1/cgi-bin/webcm"]http://192.168.1.1/cgi-bin/webcm[/url] - DIRECT/192.168.1.1 text/html
1264979188.569 1187 192.168.100.200 TCP_MISS/200 2433 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_logo.gif"]http://192.168.1.1/html/defs/style5/images/ti_menu_logo.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979188.604 1221 192.168.100.200 TCP_MISS/200 597 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_home_hilite.gif"]http://192.168.1.1/html/defs/style5/images...home_hilite.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979188.694 1311 192.168.100.200 TCP_MISS/200 1488 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_wizard.gif"]http://192.168.1.1/html/defs/style5/images...menu_wizard.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.004 511 192.168.100.200 TCP_MISS/200 575 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_setup.gif"]http://192.168.1.1/html/defs/style5/images/ti_menu_setup.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.048 479 192.168.100.200 TCP_MISS/200 701 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_advanced.gif"]http://192.168.1.1/html/defs/style5/images...nu_advanced.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.090 487 192.168.100.200 TCP_MISS/200 678 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_wireless.gif"]http://192.168.1.1/html/defs/style5/images...nu_wireless.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.125 432 192.168.100.200 TCP_MISS/200 580 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_tools.gif"]http://192.168.1.1/html/defs/style5/images/ti_menu_tools.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.272 266 192.168.100.200 TCP_MISS/200 609 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_status.gif"]http://192.168.1.1/html/defs/style5/images...menu_status.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979189.308 259 192.168.100.200 TCP_MISS/200 558 GET [url="http://192.168.1.1/html/defs/style5/images/ti_menu_help.gif"]http://192.168.1.1/html/defs/style5/images/ti_menu_help.gif[/url] - DIRECT/192.168.1.1 image/gif
1264979195.324 363 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979195.811 364 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979209.691 364 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979210.191 379 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979224.058 364 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979224.555 361 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979238.431 371 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979238.918 361 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979252.796 361 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979253.286 367 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979267.163 363 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979267.651 363 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979281.529 365 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979282.016 364 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979295.896 364 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979296.380 362 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979310.261 363 192.168.100.1 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html
1264979310.753 371 192.168.100.2 TCP_MISS/200 5039 GET [url="http://192.168.1.1/"]http://192.168.1.1/[/url] - DIRECT/192.168.1.1 text/html=====access.log================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.100.100:3128 rr persistent 600
-> 192.168.100.2:3128 Masq 1 0 0
-> 192.168.100.1:3128 Masq 1 0 0======================================================================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:d4:61:c1
inet addr:192.168.100.1 Bcast:192.168.100.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fed4:61c1/64 Диапазон:Ссылка
ВВЕРХ BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:192 errors:0 dropped:0 overruns:0 frame:0
TX packets:881 errors:0 dropped:0 overruns:0 carrier:0
коллизии:0 txqueuelen:1000
RX bytes:24595 (24.5 KB) TX bytes:95700 (95.7 KB)
Прервано:18 Base address:0x2000
eth0:0 Link encap:Ethernet HWaddr 00:0c:29:d4:61:c1
inet addr:192.168.100.2 Bcast:192.168.100.255 Mask:255.255.255.0
ВВЕРХ BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Прервано:18 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0c:29:d4:61:b7
inet addr:192.168.10.2 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fed4:61b7/64 Диапазон:Ссылка
ВВЕРХ BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1375 errors:0 dropped:0 overruns:0 frame:0
TX packets:589 errors:0 dropped:0 overruns:0 carrier:0
коллизии:0 txqueuelen:1000
RX bytes:391644 (391.6 KB) TX bytes:55695 (55.6 KB)
Прервано:19 Base address:0x2080
eth2 Link encap:Ethernet HWaddr 00:0c:29:d4:61:cb
inet addr:192.168.20.2 Bcast:192.168.20.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fed4:61cb/64 Диапазон:Ссылка
ВВЕРХ BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1275 errors:0 dropped:0 overruns:0 frame:0
TX packets:499 errors:0 dropped:0 overruns:0 carrier:0
коллизии:0 txqueuelen:1000
RX bytes:340833 (340.8 KB) TX bytes:46043 (46.0 KB)
Прервано:19 Base address:0x2400
lo Link encap:Локальная петля (Loopback)
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Диапазон:Узел
ВВЕРХ LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1732 errors:0 dropped:0 overruns:0 frame:0
TX packetg0LjEx!==============================================================================='
Код: Выделить всё
root@ubuntubalance:/home/igronin# iptables-save
# Generated by iptables-save v1.4.1.1 on Mon Feb 1 01:15:12 2010
*mangle
:PREROUTING ACCEPT [4989:1450983]
:INPUT ACCEPT [3154:1348458]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3983:851694]
:POSTROUTING ACCEPT [4031:860977]
COMMIT
# Completed on Mon Feb 1 01:15:12 2010
# Generated by iptables-save v1.4.1.1 on Mon Feb 1 01:15:12 2010
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -s 127.0.0.0/8 -i ! lo -j LOG
-A INPUT -s 127.0.0.0/8 -i ! lo -j DROP
-A INPUT -d 255.255.255.255/32 -i eth0 -j ACCEPT
-A INPUT -d 255.255.255.255/32 -i eth0 -j ACCEPT
-A INPUT -s 192.168.100.0/24 -i eth0 -j ACCEPT
-A INPUT -s 192.168.100.0/24 -i eth0 -j ACCEPT
-A INPUT -d 224.0.0.0/4 -i eth0 -p ! tcp -j ACCEPT
-A INPUT -d 224.0.0.0/4 -i eth0 -p ! tcp -j ACCEPT
-A INPUT -s 192.168.100.0/24 -i eth1 -j LOG
-A INPUT -s 192.168.100.0/24 -i eth1 -j DROP
-A INPUT -s 192.168.100.0/24 -i eth1 -j LOG
-A INPUT -s 192.168.100.0/24 -i eth1 -j DROP
-A INPUT -s 192.168.100.0/24 -i eth2 -j LOG
-A INPUT -s 192.168.100.0/24 -i eth2 -j DROP
-A INPUT -s 192.168.100.0/24 -i eth2 -j LOG
-A INPUT -s 192.168.100.0/24 -i eth2 -j DROP
-A INPUT -d 255.255.255.255/32 -i eth1 -j ACCEPT
-A INPUT -d 255.255.255.255/32 -i eth2 -j ACCEPT
-A INPUT -d 192.168.10.2/32 -i eth1 -j ACCEPT
-A INPUT -d 192.168.10.255/32 -i eth1 -j ACCEPT
-A INPUT -d 192.168.20.2/32 -i eth2 -j ACCEPT
-A INPUT -d 192.168.20.255/32 -i eth2 -j ACCEPT
-A INPUT -d 224.0.0.1/32 -j DROP
-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -s 192.168.100.0/24 -d 192.168.100.0/24 -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -d 192.168.100.0/24 -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i eth0 -o eth2 -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i eth0 -o eth2 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.100.0/24 -o eth1 -j LOG
-A FORWARD -d 192.168.100.0/24 -o eth1 -j DROP
-A FORWARD -d 192.168.100.0/24 -o eth1 -j LOG
-A FORWARD -d 192.168.100.0/24 -o eth1 -j DROP
-A FORWARD -d 192.168.100.0/24 -o eth2 -j LOG
-A FORWARD -d 192.168.100.0/24 -o eth2 -j DROP
-A FORWARD -d 192.168.100.0/24 -o eth2 -j LOG
-A FORWARD -d 192.168.100.0/24 -o eth2 -j DROP
-A FORWARD -d 224.0.0.1/32 -j DROP
-A FORWARD -j LOG
-A FORWARD -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 255.255.255.255/32 -o eth0 -j ACCEPT
-A OUTPUT -d 255.255.255.255/32 -o eth0 -j ACCEPT
-A OUTPUT -d 192.168.100.0/24 -o eth0 -j ACCEPT
-A OUTPUT -d 192.168.100.0/24 -o eth0 -j ACCEPT
-A OUTPUT -d 224.0.0.0/4 -o eth0 -p ! tcp -j ACCEPT
-A OUTPUT -d 224.0.0.0/4 -o eth0 -p ! tcp -j ACCEPT
-A OUTPUT -d 192.168.100.0/24 -o eth1 -j LOG
-A OUTPUT -d 192.168.100.0/24 -o eth1 -j DROP
-A OUTPUT -d 192.168.100.0/24 -o eth1 -j LOG
-A OUTPUT -d 192.168.100.0/24 -o eth1 -j DROP
-A OUTPUT -d 192.168.100.0/24 -o eth2 -j LOG
-A OUTPUT -d 192.168.100.0/24 -o eth2 -j DROP
-A OUTPUT -d 192.168.100.0/24 -o eth2 -j LOG
-A OUTPUT -d 192.168.100.0/24 -o eth2 -j DROP
-A OUTPUT -d 255.255.255.255/32 -o eth1 -j ACCEPT
-A OUTPUT -d 255.255.255.255/32 -o eth2 -j ACCEPT
-A OUTPUT -s 192.168.10.2/32 -o eth1 -j ACCEPT
-A OUTPUT -s 192.168.10.255/32 -o eth1 -j ACCEPT
-A OUTPUT -s 192.168.20.2/32 -o eth2 -j ACCEPT
-A OUTPUT -s 192.168.20.255/32 -o eth2 -j ACCEPT
-A OUTPUT -d 224.0.0.1/32 -j DROP
-A OUTPUT -j LOG
-A OUTPUT -j DROP
COMMIT
# Completed on Mon Feb 1 01:15:12 2010
# Generated by iptables-save v1.4.1.1 on Mon Feb 1 01:15:12 2010
*nat
:PREROUTING ACCEPT [144:20179]
:POSTROUTING ACCEPT [131:8474]
:OUTPUT ACCEPT [308:19547]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -s 192.168.100.0/24 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 -o eth1 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 -o eth2 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 -o eth2 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth2 -j MASQUERADE
COMMIT
# Completed on Mon Feb 1 01:15:12 2010=============================================================================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ip route sh
192.168.10.0 dev eth1 scope link src 192.168.10.2
192.168.20.0 dev eth2 scope link src 192.168.20.2
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.1
192.168.20.0/24 dev eth2 proto kernel scope link src 192.168.20.2
192.168.10.0/24 dev eth1 proto kernel scope link src 192.168.10.2
169.254.0.0/16 dev eth0 scope link metric 1000
default via 192.168.10.1 dev eth1 metric 100
default via 192.168.20.1 dev eth2 metric 100============================================================================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ip rule sh
0: from all lookup local
32764: from 192.168.20.2 lookup T2
32765: from 192.168.10.2 lookup T1
32766: from all lookup main
32767: from all lookup default==========================================================================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ip addr list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:0c:29:d4:61:c1 brd ff:ff:ff:ff:ff:ff
inet 192.168.100.1/24 brd 192.168.100.255 scope global eth0
inet 192.168.100.2/24 brd 192.168.100.255 scope global secondary eth0:0
inet 192.168.100.100/24 scope global secondary eth0
inet6 fe80::20c:29ff:fed4:61c1/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:0c:29:d4:61:b7 brd ff:ff:ff:ff:ff:ff
inet 192.168.10.2/24 brd 192.168.10.255 scope global eth1
inet6 fe80::20c:29ff:fed4:61b7/64 scope link
valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:0c:29:d4:61:cb brd ff:ff:ff:ff:ff:ff
inet 192.168.20.2/24 brd 192.168.20.255 scope global eth2
inet6 fe80::20c:29ff:fed4:61cb/64 scope link
valid_lft forever preferred_lft forever
5: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether 5e:2e:ae:c2:ee:e6 brd ff:ff:ff:ff:ff:ff==========================================================================
Код: Выделить всё
root@ubuntubalance:/home/igronin# ipvsadm -L --stats
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Conns InPkts OutPkts InBytes OutBytes
-> RemoteAddress:Port
TCP 192.168.100.100:3128 12 36 0 1728 0
-> 192.168.100.2:3128 12 36 0 1728 0
-> 192.168.100.1:3128 0 0 0 0 0
root@ubuntubalance:/home/igronin#===========================================================================
i Уведомление от модератора Ленивая Бестолочь Пожалуйста, используйте для оформления листингов теги [code].