Centos7.4安装配置haproxy和Keepalived补充内容

补充比较杂

1、当master服务恢复正常之后，backup机器收到消息，然后让出vip

下面是master机器服务恢复正常后，backup机器的Keepalived日志

收到master的消息通知，对方优先级是150，自己的是100，然后进入backup状态，移除vip

Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63
Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63
Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63
Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) Received advert with higher priority 150, ours 100
Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) Entering BACKUP STATE
Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) removing protocol VIPs.

　　

2、启动Keepalived服务，可以看到3个进程

[root@data-1-1 ~]# ps -ef |grep keep
root      6592     1  0 Apr12 ?        00:00:01 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0
root      6593  6592  0 Apr12 ?        00:00:01 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0
root      6594  6592  0 Apr12 ?        00:00:13 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0
root      6664  6020  0 Apr12 pts/2    00:00:01 tail -F /var/log/keepalived.log
root     19467  5979  0 10:45 pts/1    00:00:00 grep --colour=auto keep
[root@data-1-1 ~]#

　　

3、cat追加内容和覆盖内容，以及内容含有$变量符号的处理方式

转自http://www.361way.com/cat-eof-cover-append/4298.html

（1）覆盖

方式1

#!/bin/bash
cat << EOF > /root/test.txt
Hello!
My site is www.361way.com
My site is www.91it.org
Test for cat and EOF!
EOF　　

方式2

我喜欢这种

#!/bin/bash
cat > /root/test.txt <<EOF
Hello!
My site is www.361way.com
My site is www.91it.org
Test for cat and EOF!
EOF

　　

（2）追加

覆盖的写法基本和追加一样，不同的是单重定向号变成双重定向号

方式1

#!/bin/bash
cat << EOF >> /root/test.txt
Hello!
My site is www.361way.com
My site is www.91it.org
Test for cat and EOF!
EOF

方式2

#!/bin/bash
cat >> /root/test.txt <<EOF
Hello!
My site is www.361way.com
My site is www.91it.org
Test for cat and EOF!
EOF

　　

需要注意的是，不论是覆盖还是追加，在涉及到变量操作时是需要进行转义的，例如：　

#!/bin/bash
cat <<EOF >> /root/a.txt
PATH=\$PATH:\$HOME/bin
export ORACLE_BASE=/u01/app/oracle
export ORACLE_HOME=\$ORACLE_BASE/10.2.0/db_1
export ORACLE_SID=yqpt
export PATH=\$PATH:\$ORACLE_HOME/bin
export NLS_LANG="AMERICAN_AMERICA.AL32UTF8"
EOF

　　

4、正常安装之后的Keepalived服务启动日志

可以看到启动读取的配置文件和根据配置文件打印的详细信息

有些配置不在配置文件中写，它会自动按照默认配置补充上去

配置文件是单播的启动日志

下面可以看到已经涉及单播了   VRRP check unicast_src = false

vrrp_check_unicast_src：在单播模式中，开启对VRRP数据包的源地址做检查，源地址必须是单播邻居之一

Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6453]: Stopped
Apr 12 16:27:12 data-1-2 Keepalived[6451]: Stopped Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2
Apr 12 16:27:12 data-1-2 Keepalived[6602]: Starting Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2
Apr 12 16:27:12 data-1-2 Keepalived[6602]: Unable to resolve default script username 'keepalived_script' - ignoring
Apr 12 16:27:12 data-1-2 Keepalived[6602]: Opening file '/etc/keepalived/keepalived.conf'.
Apr 12 16:27:12 data-1-2 Keepalived[6603]: Starting Healthcheck child process, pid=6604
Apr 12 16:27:12 data-1-2 Keepalived_healthcheckers[6604]: Initializing ipvs
Apr 12 16:27:12 data-1-2 Keepalived[6603]: Starting VRRP child process, pid=6605
Apr 12 16:27:12 data-1-2 Keepalived_healthcheckers[6604]: Opening file '/etc/keepalived/keepalived.conf'.
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering Kernel netlink reflector
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering Kernel netlink command channel
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering gratuitous ARP shared channel
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Opening file '/etc/keepalived/keepalived.conf'.
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Instance(VI_1) removing protocol VIPs.
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: WARNING - script `killall` resolved by path search to `/usr/bin/killall`. Please specify full path.
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: SECURITY VIOLATION - scripts are being executed but script_security not enabled.
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< Global definitions >------
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Router ID = Haproxy_2
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server = 127.0.0.1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server port = 25
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp HELO name = data-1-2
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server connection timeout = 3
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Email notification from = Haproxy_KeepAlived@163.com
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Email notification = 525031638@qq.com
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Default interface = eth0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: LVS flush = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP IPv4 mcast group = 224.0.0.18
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP IPv6 mcast group = ff02::12
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP delay = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP repeat = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh timer = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh repeat = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority delay = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority repeat = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive lower priority advert = true
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive higher priority advert = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP interval = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous NA interval = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP default protocol version = 2
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Iptables input chain = INPUT
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP check unicast_src = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP skip check advert addresses = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP strict mode = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP process priority = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP don't swap = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Checker process priority = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Checker don't swap = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Network namespace = (default)
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Script security disabled
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Default script uid:gid 0:0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< VRRP Topology >------
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP Instance = VI_1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Using VRRPv2
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Want State = BACKUP
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Running on device = eth0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Skip checking advert IP addresses = no
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Enforcing strict VRRP compliance = no
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Using src_ip = 10.0.1.62
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP delay = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP repeat = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP refresh timer = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP refresh repeat = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP lower priority delay = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Gratuitous ARP lower priority repeat = 5
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Send advert after receive lower priority advert = true
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Send advert after receive higher priority advert = false
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Virtual Router ID = 80
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Priority = 100
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Advert interval = 5 sec
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Accept enabled
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Promote_secondaries disabled
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Authentication type = SIMPLE_PASSWORD
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Password = ha_keep
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Tracked scripts = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:     chk_haproxy weight 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Unicast Peer = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:     10.0.1.61
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Virtual IP = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:     10.0.1.63/24 dev eth0 scope global
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< VRRP Scripts >------
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP Script = chk_haproxy
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Command = /usr/bin/killall -0 haproxy
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Interval = 3 sec
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Timeout = 0 sec
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Weight = 0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Rise = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Fall = 1
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Insecure = no
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]:   Status = INIT
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< NIC >------
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Name = eth0
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: index = 2
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: IPv4 address = 10.0.1.62
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: IPv6 address = ::
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: MAC = 00:50:56:9d:50:d7
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: is UP
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: is RUNNING
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: MTU = 1500
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: HW Type = ETHERNET
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Using LinkWatch kernel netlink reflector...
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Instance(VI_1) Entering BACKUP STATE
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP sockpool: [ifindex(2), proto(112), unicast(1), fd(10,11)]
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Script(chk_haproxy) succeeded
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: ------< Global definitions >------
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Router ID = Haproxy_2
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server = 127.0.0.1
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server port = 25
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp HELO name = data-1-2
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server connection timeout = 3
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Email notification from = Haproxy_KeepAlived@163.com
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Email notification = 525031638@qq.com
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Default interface = eth0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: LVS flush = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP IPv4 mcast group = 224.0.0.18
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP IPv6 mcast group = ff02::12
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP delay = 5
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP repeat = 5
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP refresh timer = 0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP refresh repeat = 1
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP lower priority delay = 4294
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP lower priority repeat = -1
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Send advert after receive lower priority advert = true
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Send advert after receive higher priority advert = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP interval = 0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous NA interval = 0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP default protocol version = 2
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Iptables input chain = INPUT
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP check unicast_src = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP skip check advert addresses = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP strict mode = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP process priority = 0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP don't swap = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Checker process priority = 0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Checker don't swap = false
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Network namespace = (default)
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Script security disabled
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Default script uid:gid 0:0
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: ------< SSL definitions >------
Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Using autogen SSL context

　　

5、配置单播和组播通信区别

配置两个节点之间为单播方式，backup收到的数据包是下面形式

[root@data-1-2 keepalived]# tcpdump -vvv  -i any host 10.0.1.61
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:11:21.084843 IP (tos 0xc0, ttl 255, id 3, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
13:11:26.085600 IP (tos 0xc0, ttl 255, id 4, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
13:11:31.086772 IP (tos 0xc0, ttl 255, id 5, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel
[root@data-1-2 keepalived]#

　　

配置两个节点为组播，backup机器收到的数据包是下面形式

可以看到是vrrp.mcast.net

[root@data-1-2 keepalived]# tcpdump -vvv  -i any host 10.0.1.61
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:08:15.571761 IP (tos 0xc0, ttl 255, id 1455, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
13:08:20.572496 IP (tos 0xc0, ttl 255, id 1456, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
13:08:25.573351 IP (tos 0xc0, ttl 255, id 1457, offset 0, flags [none], proto VRRP (112), length 40)
    10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@"
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel
[root@data-1-2 keepalived]#

　　

6、查看Keepalived编译参数

大部分用不到

[root@data-1-1 tools]# tar xfz keepalived-1.3.5.tar.gz
[root@data-1-1 tools]# cd keepalived-1.3.5
[root@data-1-1 keepalived-1.3.5]# ./configure --help
`configure' configures Keepalived 1.3.5 to adapt to many kinds of systems.

Usage: ./configure [OPTION]... [VAR=VALUE]...

To assign environment variables (e.g., CC, CFLAGS...), specify them as
VAR=VALUE.  See below for descriptions of some of the useful variables.

Defaults for the options are specified in brackets.

Configuration:
  -h, --help              display this help and exit
      --help=short        display options specific to this package
      --help=recursive    display the short help of all the included packages
  -V, --version           display version information and exit
  -q, --quiet, --silent   do not print `checking ...' messages
      --cache-file=FILE   cache test results in FILE [disabled]
  -C, --config-cache      alias for `--cache-file=config.cache'
  -n, --no-create         do not create output files
      --srcdir=DIR        find the sources in DIR [configure dir or `..']

Installation directories:
  --prefix=PREFIX         install architecture-independent files in PREFIX
                          [/usr/local]
  --exec-prefix=EPREFIX   install architecture-dependent files in EPREFIX
                          [PREFIX]

By default, `make install' will install all the files in
`/usr/local/bin', `/usr/local/lib' etc.  You can specify
an installation prefix other than `/usr/local' using `--prefix',
for instance `--prefix=$HOME'.

For better control, use the options below.

Fine tuning of the installation directories:
  --bindir=DIR            user executables [EPREFIX/bin]
  --sbindir=DIR           system admin executables [EPREFIX/sbin]
  --libexecdir=DIR        program executables [EPREFIX/libexec]
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
  --datarootdir=DIR       read-only arch.-independent data root [PREFIX/share]
  --datadir=DIR           read-only architecture-independent data [DATAROOTDIR]
  --infodir=DIR           info documentation [DATAROOTDIR/info]
  --localedir=DIR         locale-dependent data [DATAROOTDIR/locale]
  --mandir=DIR            man documentation [DATAROOTDIR/man]
  --docdir=DIR            documentation root [DATAROOTDIR/doc/keepalived]
  --htmldir=DIR           html documentation [DOCDIR]
  --dvidir=DIR            dvi documentation [DOCDIR]
  --pdfdir=DIR            pdf documentation [DOCDIR]
  --psdir=DIR             ps documentation [DOCDIR]

Program names:
  --program-prefix=PREFIX            prepend PREFIX to installed program names
  --program-suffix=SUFFIX            append SUFFIX to installed program names
  --program-transform-name=PROGRAM   run sed PROGRAM on installed program names

Optional Features:
  --disable-option-checking  ignore unrecognized --enable/--with options
  --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
  --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
  --enable-silent-rules   less verbose build output (undo: "make V=1")
  --disable-silent-rules  verbose build output (undo: "make V=0")
  --disable-lvs-syncd     do not use LVS synchronization daemon
  --disable-lvs           do not use the LVS framework
  --disable-lvs-64bit-stats
                          do not use the LVS 64-bit stats
  --disable-vrrp          do not use the VRRP framework
  --disable-fwmark        compile without SO_MARK support
  --enable-snmp           compile with SNMP support
  --enable-snmp-vrrp      compile with SNMP vrrp support
  --enable-snmp-keepalived
                          obsolete - use --enable-snmp-vrrp
  --enable-snmp-checker   compile with SNMP checker support
  --enable-snmp-rfc       compile with SNMP RFC2787 (VRRPv2) and SNMP RFC6527
                          (VRRPv3) support
  --enable-snmp-rfcv2     compile with SNMP RFC2787 (VRRPv2) support
  --enable-snmp-rfcv3     compile with SNMP RFC6257 (VRRPv3) support
  --disable-snmp-reply-v3-for-v2
                          disable RFC6257 responses for VRRPv2 instances
  --enable-dbus           compile with dbus support
  --enable-dbus-create-instance
                          compile with dbus support for creating instances
  --enable-sha1           compile with SHA1 support
  --disable-vrrp-auth     compile without VRRP authentication
  --disable-routes        compile without ip rules/routes
  --enable-dynamic-linking
                          compile with/without dynamically linked
                          libiptc/libipset
  --enable-libiptc-dynamic
                          compile with libiptc dynamically linked
  --disable-libipset-dynamic
                          compile with libipset statically linked
  --enable-libxtables-dynamic
                          compile with libxtables dynamically linked
  --enable-libnl-dynamic  compile with libnl dynamically linked
  --disable-libiptc       compile without libiptc
  --disable-libipset      compile without libipset
  --disable-libnl         compile without libnl
  --enable-mem-check      compile with memory alloc checking
  --enable-mem-check-log  compile with memory alloc checking wriging to syslog
  --enable-debug          compile with debugging flags
  --enable-stacktrace     compile with stacktrace support
  --enable-profile        compile with profiling flags
  --enable-conversion-checks
                          compile with conversion warnings if sensible
  --enable-force-conversion-checks
                          compile with conversion warnings
  --enable-Werror         compile with warnings being errors
  --enable-dependency-tracking
                          do not reject slow dependency extractors
  --disable-dependency-tracking
                          speeds up one-time build

Optional Packages:
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
  --with-kernel-dir=DIR   path to linux kernel source directory
  --with-init=(upstart|systemd|SYSV|SUSE|openrc)
                          specify init type
  --with-systemdsystemunitdir=DIR
                          Directory for systemd service files

Some influential environment variables:
  PKG_CONFIG  path to pkg-config utility
  PKG_CONFIG_PATH
              directories to add to pkg-config's search path
  PKG_CONFIG_LIBDIR
              path overriding pkg-config's built-in search path
  CC          C compiler command
  CFLAGS      C compiler flags
  LDFLAGS     linker flags, e.g. -L<lib dir> if you have libraries in a
              nonstandard directory <lib dir>
  LIBS        libraries to pass to the linker, e.g. -l<library>
  CPPFLAGS    (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
              you have headers in a nonstandard directory <include dir>
  CPP         C preprocessor

Use these variables to override the choices made by `configure' or to help
it to find libraries and programs with nonstandard names/locations.

Report bugs to <keepalived-devel@lists.sourceforge.net>.
Keepalived home page: <http://www.keepalived.org/>.
[root@data-1-1 keepalived-1.3.5]#

　　

7、Keepalived修改日志文件输出路径

keepalived默认输出的日志在/var/log/messages

这里修改，让它输出到/var/log/keepalived.log

编译安装的1.3.5版本
看到启动脚本默认读取的是/application/keepalived-1.3.5/etc/sysconfig/keepalived这个文件
但是别的一些默认读取的是/etc/sysconfig/keepalived
都改了
最下面添加一行
-S指定一个syslog设备接收,0表示local0设备
-D是详细日志
-d是dump配置文件内容到日志中

sed -i s#'KEEPALIVED_OPTIONS="-D"'#'KEEPALIVED_OPTIONS="-D -d -S 0"'#g  /etc/sysconfig/keepalived
/bin/cp  /application/keepalived/etc/sysconfig/keepalived /etc/sysconfig/

　　

配置完毕后需要在syslog.conf文件里添加一行，如下
上面配置文件表示syslog让local0接收，local0接收后往后面的/var/log/keepalived.log里面接收
.* 表示所有状态都打

cat >> /etc/rsyslog.conf << EOF
#keepalived
local0.*         /var/log/keepalived.log
EOF

[root@data-1-1 keepalived]# tail -2 /etc/rsyslog.conf
#keepalived
local0.*         /var/log/keepalived.log
[root@data-1-1 keepalived]#

　　

重启rsyslog服务

[root@data-1-1 keepalived]# systemctl restart rsyslog
[root@data-1-1 keepalived]#

　

8、安装一些工具

安装tcpdump，它是个抓包工具，有时候会用到
安装psmisc包，安装之后多了 fuser, killall,pstree等命令，Keepalived的配置文件中健康检查能用到它

yum install tcpdump -y
yum install psmisc -y

　　

9、为同一个虚拟IP服务的实例，虚拟路由id必须一致

同一集群的keepalived的主、备机的virtual_router_id 必须相同,取值0-255
但是同一内网中不应有相同virtual_router_id的集群

10、多实例的Keepalived配置文件参考

这样两个机器都在工作，不至于类似单实例有资源浪费的情况

机器1的Keepalived配置

VI_1是master，VI_2是backup

! Configuration File for keepalived

global_defs {
   notification_email {
   12345@qq.com
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 10.0.0.1
   smtp_connect_timeout 30
   router_id LVS_1
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 150
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.136/24
        10.0.0.137/24
        10.0.0.138/24
    }
}

vrrp_instance VI_2 {
    state BACKUP
    interface eth0
    virtual_router_id 52
    priority 50
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.140/24
        10.0.0.141/24
    }
}

　　

机器2的Keepalived配置

VI_1是backup，VI_2是master

! Configuration File for keepalived

global_defs {
   notification_email {
   12345@qq.com
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 10.0.0.1
   smtp_connect_timeout 30
   router_id LVS_2
}

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.136/24
        10.0.0.137/24
        10.0.0.138/24
    }
}

vrrp_instance VI_2 {
    state MASTER
    interface eth0
    virtual_router_id 52
    priority 150
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.0.0.140/24
        10.0.0.141/24
    }
}

　　

11、编译Keepalived中出现如下warning不用理会

系统出现警告信息“*** WARNING - this build will not support IPVS with IPv6. Please install libnl/libnl-3 dev libraries to support IPv6 with IPVS.”，具体日志如下

Keepalived configuration
------------------------
Keepalived version       : 1.3.5
Compiler                 : gcc
Preprocessor flags       :
Compiler flags           : -Wall -Wunused -Wstrict-prototypes -Wextra -g -O2
Linker flags             :
Extra Lib                :  -lcrypto  -lssl
Use IPVS Framework       : Yes
IPVS use libnl           : No
IPVS syncd attributes    : No
IPVS 64 bit stats        : No
fwmark socket support    : Yes
Use VRRP Framework       : Yes
Use VRRP VMAC            : Yes
Use VRRP authentication  : Yes
With ip rules/routes     : Yes
SNMP vrrp support        : No
SNMP checker support     : No
SNMP RFCv2 support       : No
SNMP RFCv3 support       : No
DBUS support             : No
SHA1 support             : No
Use Debug flags          : No
Stacktrace support       : No
Memory alloc check       : No
libnl version            : None
Use IPv4 devconf         : No
Use libiptc              : No
Use libipset             : No
init type                : upstart
Build genhash            : Yes
Build documentation      : No

*** WARNING - this build will not support IPVS with IPv6. Please install libnl/libnl-3 dev libraries to support IPv6 with IPVS.

　

很多人通过安装下面依赖解决它，我觉得没必要，因为压根用不到ipv6的东西

解决方案一：（在线安装）
执行yum命令yum -y install libnl libnl-devel解决上述警告问题
执行yum命令yum install -y libnfnetlink-devel解决上述错误问题

　

12、阿里云下载镜像得路径注意下，是isos

https://mirrors.aliyun.com/centos/7.4.1708/isos/x86_64/

13、Keepalived中配置文件也可以自定义监控脚本

#自定义监控脚本
vrrp_script chk_haproxy {
        script "/etc/keepalived/check_haproxy.sh"
        interval 5
        weight 2
}

　　

14、Keepalived和haproxy配置文件详解

来自下面链接

https://blog.csdn.net/HzSunshine/article/details/61673572

简单参考下

! Configuration File for keepalived
global_defs {
   #设置报警通知邮件地址，可以设置多个
   notification_email {
    msun1996@163.com
   }
   #设置邮件的发送地址
   notification_email_from keepalived@msun.com
   #设置smtp server的地址,该地址必须是存在的
   smtp_server 127.0.0.1
   #设置连接smtp server的超时时间
   smtp_connect_timeout 30
   #运行Keepalived服务器的标识，发邮件时显示在邮件标题中的信息
   router_id HAProxy_msun
}
# 检测haproxy脚本
vrrp_script chk_haproxy {
    script "/etc/keepalived/check_haproxy.sh"
    interval 2
    #下面方法相对更优
    #script "killall -0 haproxy"  #killall (安装 yum install psmisc -y)
    #interval 2
    #weghit 2 #权值脚本成功时（0）等于priority+weghit #否则为priority
}
#定义VRRP实例,实例名自定义
vrrp_instance haproxy_msun {
    #指定Keepalived的角色，MASTER为主服务器，BACKUP为备用服务器
    state MASTER #从设置为BACKUP
    #指定HA监测的接口
    interface eno16777736
    #虚拟路由标识，这个标识是一个数字(1-255)，在一个VRRP实例中主备服务器ID必须一样
    virtual_router_id 68
    #优先级，数字越大优先级越高，在一个实例中主服务>器优先级要高于备服务器
    priority 100 #从设置为99
    #设置主备之间同步检查的时间间隔单位秒
    advert_int 1
    #设置验证类型和密码
    authentication {
        #验证类型有两种{PASS|HA}
        auth_type PASS
        #设置验证密码，在一个实例中主备密码保持一样
        auth_pass 1689
    }
    track_script {
        chk_haproxy  # 执行监控的服务
    }
    #定义虚拟IP地址,可以有多个，每行一个
    virtual_ipaddress {
    192.168.1.160
    }
}

　　

haproxy配置文件详解1

简单参考下

global
    #全区日志配置 使用rsyslog的local3设备
    log         127.0.0.1 local3 info
    #工作目录（安全）
    chroot      /var/lib/haproxy
    #pid文件存储目录
    pidfile     /var/run/haproxy.pid
    #后台进程数量
    nbproc 1
    #每个进程最大并发数
    maxconn     40000
    user        haproxy
    group       haproxy
    #后台程序模式工作
    daemon

defaults
    mode                    http
    #后端连接重试次数，超出标识不可用
    retries                 3
    #连接服务器最长等待时间
    timeout connect         10s
    #客户端发送请求最长等待时间
    timeout client          30s
    #服务器会复客户端最长等待时间
    timeout server          30s
    #对后端服务器的检测超时时间
    timeout check           10s 

#定义HAProxy监控页面
listen admin_stats
    bind 0.0.0.0:9188
    mode http
    log 127.0.0.1 local3 err
    #HAProxy监控页面统计自动刷新时间。
    stats refresh 30s
    #设置监控页面URL路径。 http：//IP:9188/haproxy-status可查看
    stats uri /haproxy-status
    #统计页面密码框提示信息
    stats realm welcome login\ Haproxy
    #登录统计页面用户和密码
    stats auth admin:123456
    #隐藏HAProxy版本信息
    stats hide-version
    #设置TURE后可在监控页面手工启动关闭后端真实服务器
    stats admin if TRUE

#定义前端虚拟节点
frontend www
    #监听端口
    bind *:80
    mode http
    #启用日志记录HTTP请求。
    option httplog
    #启用后后端服务器可以获得客户端IP
    option forwardfor
    #客户端和服务器完成一次连接请求后，HAProxy主动关闭TCP链接（优化选项）
    option httpclose
    #使用全局日志配置
    log global
    #指定后端服务池（backend定义htmpool）
    default_backend htmpool

#定义后端真实服务器
backend htmpool
    mode http
    #用于cookie保持环境。（如后端服务器故障，客户端cookie不会刷新，用此来把用户请求强制定向到正常服务器）
    option redispatch
    #负载均衡很高时，自动结束当前队列处理时间长的连接
    option abortonclose
    #负载均衡算法
    balance roundrobin
    #允许向cookie插入SERVERID.下面server可以使用cookie定义
    cookie SERVERID
    #启用HTTP服务状态检测功能 （后端服务器一定要存在此文件，不然haproxy认为其故障）
    option httpchk GET /index.html
    #后端服务设置
    server web1 192.168.1.186:80 cookie server1 weight 6 check inter 2000 rise 2 fall 3
    server web2 192.168.1.188:80 cookie server2 weight 6 check inter 2000 rise 2 fall 3

　　

haproxy配置文件参考2

来自http://blog.chinaunix.net/uid-25266990-id-3989321.html

这里主要看下acl规则

#vim /etc/haproxy/haproxy.cfg
# this config needs haproxy-1.1.28 or haproxy-1.2.1
global
    log 127.0.0.1   local0  #日志输出配置，所有日志都记录在本机，通过local0输出
    log 127.0.0.1   local1 notice
    #log loghost    local0 info
    maxconn 4096                #最大连接数
    chroot /usr/share/haproxy   #改变当前工作目录。
    uid 99                  #所属用户的uid
    gid 99                  #所属运行的gid
    daemon                  #以后台形式运行haproxy
    #debug
    #quiet

defaults
    log global
    mode    http
　　#默认的模式mode { tcp|http|health }，tcp是4层，http是7层，health只会返回OK
    option  httplog
    option  dontlognull
    option   redispatch
　　#当serverId对应的服务器挂掉后，强制定向到其他健康的服务器
    option  abortonclose
　　#当服务器负载很高的时候，自动结束掉当前队列处理比较久的链接
    retries 3               #两次连接失败就认为是服务器不可用
    maxconn 2000            #默认的最大连接数
　　#timeout http-keep-alive 10s
　　# timeout queue 1m
    contimeout  5000        #连接超时
    clitimeout  50000       #客户端超时
    srvtimeout  50000       #服务器超时
    timeout check 5s            #心跳检测超时
    stats refresh 30s           #统计页面自动刷新时间
    stats uri  /stats           #统计页面url
    stats realm baison-test-Haproxy         #统计页面密码框上提示文本
    stats auth admin:admin123           #统计页面用户名和密码设置
    stats hide-version                  #隐藏统计页面上HAProxy的版本信息
frontend www
    bind *:80
    #这里建议使用bind *:80的方式，要不然做集群高可用的时候有问题，vip切换到其他机器就不能访问了。
    acl web hdr(host) -i www.zhirs.com
    #acl后面是规则名称，-i是要访问的域名，如果访问www.zhirs.com这个域名就分发到下面的webserver 的作用域。
    acl img hdr(host) -i img.zhirs.com
    #如果访问img.baison.com.cn就分发到imgserver这个作用域。
    use_backend webserver if web
    use_backend imgserver if img

backend webserver             #webserver作用域
    mode http
    balance   roundrobin
    #banlance roundrobin 轮询，balance source 保存session值，支持static-rr，leastconn，first，uri等参数
    option  httpchk /index.html
    #检测文件，如果分发到后台index.html访问不到就不再分发给它
    server     web01 192.168.137.201:80  check inter 2000 fall 3 weight 30
　　 server     web01 192.168.137.202:80  check inter 2000 fall 3 weight 20
　　 server     web01 192.168.137.203:80  check inter 2000 fall 3 weight 10

backend imgserver
    mode http
    option  httpchk /index.php
    balance     roundrobin
    server      img01 192.168.137.101:80  check inter 2000 fall 3
    server      img02 192.168.137.102:80  check inter 2000 fall 3

　　

haproxy参考配置3

来自

https://blog.csdn.net/sj349781478/article/details/78862315

global
　　log 127.0.0.1 local0 #[日志输出配置，所有日志都记录在本机，通过local0输出]
　　log 127.0.0.1 local1 notice #定义haproxy 日志级别[error warringinfo debug]
　　daemon #以后台形式运行harpoxy
　　nbproc 1 #设置进程数量
　　maxconn 4096 #默认最大连接数,需考虑ulimit-n限制
　　#user haproxy #运行haproxy的用户
　　#group haproxy #运行haproxy的用户所在的组
　　#pidfile /var/run/haproxy.pid #haproxy 进程PID文件
　　#ulimit-n 819200 #ulimit 的数量限制
　　#chroot /usr/share/haproxy #chroot运行路径
　　#debug #haproxy 调试级别，建议只在开启单进程的时候调试
　　#quiet

########默认配置############
defaults
　　log global
　　mode http #默认的模式mode { tcp|http|health }，tcp是4层，http是7层，health只会返回OK
　　option httplog #日志类别,采用httplog
　　option dontlognull #不记录健康检查日志信息
　　retries 2 #两次连接失败就认为是服务器不可用，也可以通过后面设置
　　#option forwardfor #如果后端服务器需要获得客户端真实ip需要配置的参数，可以从Http Header中获得客户端ip
　　option httpclose #每次请求完毕后主动关闭http通道,haproxy不支持keep-alive,只能模拟这种模式的实现
　　#option redispatch #当serverId对应的服务器挂掉后，强制定向到其他健康的服务器，以后将不支持
　　option abortonclose #当服务器负载很高的时候，自动结束掉当前队列处理比较久的链接
　　maxconn 4096 #默认的最大连接数
　　timeout connect 5000ms #连接超时
　　timeout client 30000ms #客户端超时
　　timeout server 30000ms #服务器超时
　　#timeout check 2000 #心跳检测超时
　　#timeout http-keep-alive10s #默认持久连接超时时间
　　#timeout http-request 10s #默认http请求超时时间
　　#timeout queue 1m #默认队列超时时间
　　balance roundrobin #设置默认负载均衡方式，轮询方式
　　#balance source #设置默认负载均衡方式，类似于nginx的ip_hash
　　#balnace leastconn #设置默认负载均衡方式，最小连接数

########统计页面配置########
listen stats
　　bind 0.0.0.0:1080 #设置Frontend和Backend的组合体，监控组的名称，按需要自定义名称
　　mode http #http的7层模式
　　option httplog #采用http日志格式
　　#log 127.0.0.1 local0 err #错误日志记录
　　maxconn 10 #默认的最大连接数
　　stats refresh 30s #统计页面自动刷新时间
　　stats uri /stats #统计页面url
　　stats realm XingCloud\ Haproxy #统计页面密码框上提示文本
　　stats auth admin:admin #设置监控页面的用户和密码:admin,可以设置多个用户名
　　stats auth Frank:Frank #设置监控页面的用户和密码：Frank
　　stats hide-version #隐藏统计页面上HAProxy的版本信息
　　stats admin if TRUE #设置手工启动/禁用，后端服务器(haproxy-1.4.9以后版本)

########设置haproxy 错误页面#####
#errorfile 403 /home/haproxy/haproxy/errorfiles/403.http
#errorfile 500 /home/haproxy/haproxy/errorfiles/500.http
#errorfile 502 /home/haproxy/haproxy/errorfiles/502.http
#errorfile 503 /home/haproxy/haproxy/errorfiles/503.http
#errorfile 504 /home/haproxy/haproxy/errorfiles/504.http

########frontend前端配置##############
frontend main
　　bind *:80 #这里建议使用bind *:80的方式，要不然做集群高可用的时候有问题，vip切换到其他机器就不能访问了。
　　acl web hdr(host) -i www.abc.com  #acl后面是规则名称，-i为忽略大小写，后面跟的是要访问的域名，如果访问www.abc.com这个域名，就触发web规则，。
　　acl img hdr(host) -i img.abc.com  #如果访问img.abc.com这个域名，就触发img规则。
　　use_backend webserver if web   #如果上面定义的web规则被触发，即访问www.abc.com，就将请求分发到webserver这个作用域。
　　use_backend imgserver if img   #如果上面定义的img规则被触发，即访问img.abc.com，就将请求分发到imgserver这个作用域。
　　default_backend dynamic #不满足则响应backend的默认页面

########backend后端配置##############
backend webserver #webserver作用域
　　mode http
　　balance roundrobin #balance roundrobin 负载轮询，balance source 保存session值，支持static-rr，leastconn，first，uri等参数
　　option httpchk /index.html HTTP/1.0 #健康检查, 检测文件，如果分发到后台index.html访问不到就不再分发给它
　　server web1 10.16.0.9:8085 cookie 1 weight 5 check inter 2000 rise 2 fall 3
　　server web2 10.16.0.10:8085 cookie 2 weight 3 check inter 2000 rise 2 fall 3
　　#cookie 1表示serverid为1，check inter 1500 是检测心跳频率
　　#rise 2是2次正确认为服务器可用，fall 3是3次失败认为服务器不可用，weight代表权重

backend imgserver
　　mode http
　　option httpchk /index.php
　　balance roundrobin
　　server img01 192.168.137.101:80 check inter 2000 fall 3
　　server img02 192.168.137.102:80 check inter 2000 fall 3

backend dynamic
　　balance roundrobin
　　server test1 192.168.1.23:80 check maxconn 2000
　　server test2 192.168.1.24:80 check maxconn 2000

listen tcptest
　　bind 0.0.0.0:5222
　　mode tcp
　　option tcplog #采用tcp日志格式
　　balance source
　　#log 127.0.0.1 local0 debug
　　server s1 192.168.100.204:7222 weight 1
　　server s2 192.168.100.208:7222 weight 1

　　

15、如果两台Keepalived机器必须开启防火墙的话

假设这里不使用firewalld，使用的是iptables

需要添加源地址信任。不然无法收到心跳报文

master机器添加backup机器的信任

[root@data-1-1 ~]# iptables -I INPUT -s 10.0.1.62 -j ACCEPT
[root@data-1-1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.0.1.62            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@data-1-1 ~]#

　　

backup机器添加下来自master机器的信任

[root@data-1-2 ~]# iptables -I INPUT -s 10.0.1.61 -j ACCEPT
[root@data-1-2 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.0.1.61            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@data-1-2 ~]#

　　

16、模拟裂脑

假如backup机器防火墙设置不当，没允许master的报文。它收不到master的心跳报文，就认为master机器服务down机或者Keepalived服务死掉了

它会自动添加vip，可以看到最后10.0.1.63这个vip自动配置上了。这样就出现裂脑了

[root@data-1-2 ~]# iptables -L -n -t filter --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:18181
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8181
3    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
4    ACCEPT     all  --  10.0.1.61            0.0.0.0/0
5    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
[root@data-1-2 ~]# iptables -D INPUT 4
[root@data-1-2 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:18181
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8181
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@data-1-2 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@data-1-2 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.0.1.63/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
[root@data-1-2 ~]#

　　

而此时master机器也没释放资源

[root@data-1-1 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:50:56:9d:0b:ee brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.61/24 brd 10.0.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.0.1.63/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
[root@data-1-1 ~]#

　　

修复规则，放行来自master机器的数据包，裂脑情况消失

[root@data-1-2 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.0.1.63/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
[root@data-1-2 ~]# iptables -I INPUT -s 10.0.1.61 -j ACCEPT
[root@data-1-2 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0
       valid_lft forever preferred_lft forever
[root@data-1-2 ~]#

　　

下面是一些常用的添加防火墙规则的命令

iptables  -I INPUT  -p tcp   --dport 22  -j ACCEPT
iptables  -I INPUT  -p tcp   --dport 8181  -j ACCEPT
iptables  -I INPUT  -p tcp   --dport 18181  -j ACCEPT
iptables  -A INPUT  -j DROP