搭建负均衡
第一个里程碑(服务端)
主要依赖 upstream 和 proxy 两模块实现负载均衡
- 1.配置Nginx官方源
配置
[root@web02 ~]# cat /etc/yum.repos.d/nginx.repo
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1
检查
[root@lb01 ~]# yum repolist
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.aliyun.com
* extras: mirrors.aliyun.com
* updates: mirrors.aliyun.com
repo id repo name status
base/7/x86_64 CentOS-7 - Base - mirrors.aliyun.com 10,019
epel/x86_64 Extra Packages for Enterprise Linux 7 - x86_64 13,225
extras/7/x86_64 CentOS-7 - Extras - mirrors.aliyun.com 409
nginx/x86_64 nginx repo 152
updates/7/x86_64 CentOS-7 - Updates - mirrors.aliyun.com 2,076
repolist: 25,881
- 2.下载nginx
[root@lb01 ~]# yum install -y nginx
- 3.配置nginx主配置文件
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
sendfile on;
keepalive_timeout 65;
#include /etc/nginx/conf.d/*.conf;
}
- 4.配置upstream模块添加“池”
upstream web_pools {
server 10.0.0.7:80 weight=1 max_fails=3 fail_timeout=10s;
server 10.0.0.8:80 weight=1 max_fails=3 fail_timeout=10s;
weight=1权重：默认值为1。 权重值越大接受请求比例越大。
max_fails=3 nginx健康检查，nginx尝试连接后端主机次数。
fail_timeout=10s nginx十秒后再尝试连接后端连接失败主机，默认十秒。
- 5.添加域名访问模式—proxy模块
server {
listen 80;
server_name www.oldboy.com;
location / {
proxy_pass http://web_pools; #转发信息（域名信息）给谁（web_pools）
proxy_set_header Host $host; #修改请求报文头
proxy_set_header X-Forwarded-For $remote_addr; #将用户真实IP记录到日志
}
}
server {
listen 80;
server_name blog.oldboy.com;
location / {
proxy_pass http://web_pools;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}
负载均衡 用户IP记录web服务器日志.png
- 6.完整负载均衡nginx配置文件
[root@lb01 ~]# cat /etc/nginx/nginx.conf
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
upstream web_pools {
server 10.0.0.7:80 weight=1 max_fails=3 fail_timeout=10s;
server 10.0.0.8:80 weight=1 max_fails=3 fail_timeout=10s;
}
#gzip on;
#include /etc/nginx/conf.d/*.conf;
server {
listen 80;
server_name www.oldboy.com;
location / {
proxy_pass http://web_pools;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}
server {
listen 80;
server_name blog.oldboy.com;
location / {
proxy_pass http://web_pools;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}
}
- 7.简单的安全机制
[root@lb01 ~]# vim /etc/nginx/nginx.conf
#include /etc/nginx/conf.d/*.conf;
server {
listen 80;
server_name www.oldboy.com;
location / {
if ( $remote_addr ~ "^192.168.22.") {
return 403 "biedaoluan\n";
}
proxy_pass http://web_pools;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}
作者：楚辞啊
链接：https://www.jianshu.com/p/e5cf9ec500d5
来源：简书
简书著作权归作者所有，任何形式的转载都请联系作者获得授权并注明出处。
这个简单的机制虽然可以阻挡他访问页面，但是阻挡不了他进入服务器。
所以，为了更安全，可以使用防火墙
1.下载，启动
[root@lb01 ~]# yum install -y iptables
[root@lb01 ~]# systemctl restart iptables
2.添加防火墙规则
禁止所任人访问这台主机的22端口，慎用，有可能把自己拒之门外。
[root@lb01 ~]# iptables -A INPUT -p tcp --dport 22 -j DROP
禁止这个网段的人访问，这样就可以禁止这个网段的人访问服务器。
[root@lb01 ~]# #iptables -A INPUT -p tcp -s 192.168.22.0/24 -j DROP（禁止这个网段的人访问服务器）
[root@lb01 ~]# iptables -L -n （查看已经添加的规则）
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
测试完以后清空路由规则，防止以后坑自己
- 清除路由规则三步骤（啊哈哈哈哈哈）
[root@lb01 ~]# iptables -F
[root@lb01 ~]# iptables -X
[root@lb01 ~]# iptables -Z
作者：楚辞啊
链接：https://www.jianshu.com/p/e5cf9ec500d5
来源：简书
简书著作权归作者所有，任何形式的转载都请联系作者获得授权并注明出处。
第二个里程碑（web服务器创建测试环境）
- web服务器配置文件
[root@web02 ~]# cat /etc/nginx/conf.d/02-blog.conf
server {
listen 80;
server_name blog.oldboy.com;
access_log /var/log/nginx/access_blog.log main;
root /app/blog;
location / {
index index.php index.html index.htm;
}
location ~* \.(php|php5)$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
[root@web02 ~]# cat /etc/nginx/conf.d/01_www.conf
server {
listen 80;
access_log /var/log/nginx/access_www.log main ;
server_name www.oldboy.com;
location / {
root /app/www;
index index.html index.htm;
}
}
