CentOS+Keepalived搭建主备双网关

ゝ一纸荒年。 2022-01-14 23:01 462阅读 0赞

### **背景** ###

公司有几段公网是用云主机做网关的，且与IDC互联的是/30的一个IP。为了业务可靠，避免网关单点问题，需要做主备两个网关。主的宕机能自动切去备用网关。

### **施作方案** ###

CentOS+Keepalived+float vip

### **开始部署** ###

实验环境拓扑图如下所示：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70][]

一、配置CentOS云主机

主要是开设两台Centos6.9云主机，挂好两个网卡，一个做WAN卡，一个做LAN卡。配置好IP地址，启用路由转发，iptables配置允许转发。

此处不是重点，具体步骤不阐述。

二、安装Keepalived并配置

Centos6.9下可以直接yum安装，如果提示没有找到包，可以先安装epel源

yum install epel-release -y
    
    yum install keepalived -y

接下来配置keepalived

Master配置如下：

vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived
    
    global_defs {
       notification_email {
         XXX@nxera.net
         XXXXX@qq.com
       }
       notification_email_from root@localhost
       smtp_server localhost
       smtp_connect_timeout 30
       router_id GW01
    }
    
    vrrp_script chk_maintainace {
            script "/etc/keepalived/health_check.sh"
            interval 3  
            weight -2
    }
    
    vrrp_instance VI_1 {
        state MASTER
        interface eth1
        virtual_router_id 51
        priority 101
        advert_int 1
        authentication {
            auth_type PASS
            auth_pass 123456
        }
        track_script {
            chk_maintainace
        }
        virtual_ipaddress {
            192.168.10.254/24 dev eth1
    	192.168.0.253/24 dev eth0
        }
        notify_master "/etc/keepalived/autosw.sh master"
        notify_backup "/etc/keepalived/autosw.sh backup"
        notify_fault "/etc/keepalived/autosw.sh fault"
    }

Backup配置：

! Configuration File for keepalived
    
    global_defs {
       notification_email {
         acassen@firewall.loc
         failover@firewall.loc
         sysadmin@firewall.loc
       }
       notification_email_from root@localhost
       smtp_server localhost
       smtp_connect_timeout 30
       router_id GW02
    }
    
    vrrp_script chk_maintainace {
            script "/etc/keepalived/health_check.sh"
            interval 3
            weight -2
    }
    
    vrrp_instance VI_1 {
        state BACKUP
        interface eth1
        virtual_router_id 51
        priority 100
        advert_int 1
        authentication {
            auth_type PASS
            auth_pass 123456
        }
        track_script {
            chk_maintainace
        }
        virtual_ipaddress {
            192.168.10.254/24 dev eth1
            192.168.0.253/24 dev eth0
        }
        notify_master "/etc/keepalived/autosw.sh master"
        notify_backup "/etc/keepalived/autosw.sh backup"
        notify_fault "/etc/keepalived/autosw.sh fault"
    }

解释下上述配置的意思：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 1][]

这边是邮件通告的相关配置，此方案另有脚本方式邮件告警。

最下面是标识ID，根据不同角色区别开就好。

![20190614104842740.png][]

此处配置了一个网关机器健康检查的脚本，每3秒检查一次。出问题了的话，优先级降级2.

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 2][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 3][]

配置文件中会使用到的脚本内容

health\_check.sh，脚本返回值为1时，表明不健康。

###health_check.sh
    #!/bin/bash
    #
    
    if [ "`ip addr show | grep 192.168.0.253`" == "" ] || [ "`ip addr show | grep 192.168.10.254`" == "" ];then
    #	echo "$? Is Null"
    	exit 1
    else
    #	echo "$? Not Null"
    	exit 0
    fi

autosw.sh，此脚本参考博文：[https://blog.51cto.com/13520924/2094236][https_blog.51cto.com_13520924_2094236]

此脚本能生效的前提是，网关机器能成功发送邮件。本方案按照的是sendmail，然后在/etc/mail.rc最后面加上smtp信息

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 4][]

###autosw.sh
    #!/bin/bash
    #
    contact='354519347@qq.com'
    notify() {
    mailsubject="$(hostname) to be $1, vip floating"
    mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be $1"
    echo "$mailbody" | mail -s "$mailsubject" $contact
    }
    case $1 in
    master)
    notify master
    ;;
    backup)
    notify backup
    ;;
    fault)
    notify fault
    ;;
    *)
    echo "Usage: $(basename $0) {master|backup|fault}"
    exit 1
    ;;
    esac

三、启动keepalived并设置开机自启

分别在主备两台网关机器上面输入下面指令

service keepalived start
    chkconfig keepalived on

四、检查浮动IP，以及自动切换功能

Master：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 5][]

Backup：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 6][]

给Master使点坏（关机或者ifdown一个网卡），观察浮动IP和网络稳定状况

![Master][] Master![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 7][] Backup![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 8][] ping出去发现主备网关切换的时候会有一个掉包![20190614110642589.png][] Master切换后有告警邮件

Master网关恢复后，浮动IP也会自动切回。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 9][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70]: /images/20220114/6488848e57fa4054ab5ed43c6d1dacbf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 1]: /images/20220114/db8f5c5eb0cc46759c879b2237e41273.png
[20190614104842740.png]: /images/20220114/d6980295c22c4d69968ceaefee28a9a9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 2]: /images/20220114/a25240396cd94648a58074f05b40ffe0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 3]: /images/20220114/5cc7c93adf944489a3ba8b76136411d3.png
[https_blog.51cto.com_13520924_2094236]: https://blog.51cto.com/13520924/2094236
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 4]: /images/20220114/4179ea08a21e4e4abb869617977d149c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 5]: /images/20220114/947b0784b59d4a9e9bd4d0367f577082.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 6]: /images/20220114/223b475542744c679129604f3e4137ce.png
[Master]: https://img-blog.csdnimg.cn/20190614110710434.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20190614110809859.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/20190614110654218.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5,size_16,color_FFFFFF,t_70
[20190614110642589.png]: /images/20220114/197cfc642bdd4bb48e27ae04985e379c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTY1NDU5_size_16_color_FFFFFF_t_70 9]: /images/20220114/0e212152bcd8472c9ecd01006725724e.png