--------------------------------------------------------------------------------------------------------------------------
关闭 SElinux、配置防火墙（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# vim /etc/sysconfig/selinux
#SELINUX=enforcing #注释掉
#SELINUXTYPE=targeted #注释掉
SELINUX=disabled #增加
[root@Haproxy_Keepalived_Master ~]# setenforce 0 #临时关闭selinux。上面文件配置后，重启机器后就永久生效。
注意下面182.148.15.0/24是服务器的公网网段，192.168.1.0/24是服务器的私网网段
一定要注意：加上这个组播规则后，MASTER和BACKUP故障时，才能实现VIP资源的正常转移。其故障恢复后，VIP也还会正常转移回来。
[root@Haproxy_Keepalived_Master ~]# vim /etc/sysconfig/iptables
.......
-A INPUT -s 182.148.15.0/24 -d 224.0.0.18 -j ACCEPT #允许组播地址通信。
-A INPUT -s 192.168.1.0/24 -d 224.0.0.18 -j ACCEPT
-A INPUT -s 182.148.15.0/24 -p vrrp -j ACCEPT #允许 VRRP（虚拟路由器冗余协）通信
-A INPUT -s 192.168.1.0/24 -p vrrp -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
[root@Haproxy_Keepalived_Master ~]# /etc/init.d/iptables restart
----------------------------------------------------------------------------------------------------------------------
下载Haproxy地址：/download/1.6/src/
1）安装Haproxy（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作） 注意：安装之前，先执行yum install gcc gcc-c++ make openssl-devel kernel-devel
[root@Haproxy_Keepalived_Master src]# wget /download/1.6/src/haproxy-1.6.12.tar.gz
[root@Haproxy_Keepalived_Master src]# tar -zvxf haproxy-1.6.12.tar.gz
[root@Haproxy_Keepalived_Master src]# cd haproxy-1.6.12
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# make TARGET=linux26 CPU=x86_64 PREFIX=/usr/local/haprpxy USE_OPENSSL=1 ADDLIB=-lz
参数说明：
TARGET=linux26 #使用 uname -r 查看内核，如：2.6.32-642.el6.x86_64，此时该参数就为linux26
CPU=x86_64 #使用 uname -r 查看系统信息，如 x86_64 GNU/Linux，此时该参数就为 x86_64
PREFIX=/usr/local/haprpxy #haprpxy 安装路径
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# ldd haproxy | grep ssl
libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f6f3d9b2000)
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# make install PREFIX=/usr/local/haproxy
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# mkdir -p /usr/local/haproxy/conf
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# mkdir -p /etc/haproxy
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# cp /usr/local/src/haproxy-1.6.12/examples/option-http_proxy.cfg /usr/local/haproxy/conf/haproxy.cfg
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# ln -s /usr/local/haproxy/conf/haproxy.cfg /etc/haproxy/haproxy.cfg
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# cp -r /usr/local/src/haproxy-1.6.12/examples/errorfiles /usr/local/haproxy/errorfiles
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# ln -s /usr/local/haproxy/errorfiles /etc/haproxy/errorfiles
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# mkdir -p /usr/local/haproxy/log
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# touch /usr/local/haproxy/log/haproxy.log
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# ln -s /usr/local/haproxy/log/haproxy.log /var/log/haproxy.log
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# cp /usr/local/src/haproxy-1.6.12/examples/haproxy.init /etc/rc.d/init.d/haproxy
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# chmod +x /etc/rc.d/init.d/haproxy
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# chkconfig haproxy on
[root@Haproxy_Keepalived_Master haproxy-1.6.12]# ln -s /usr/local/haproxy/sbin/haproxy /usr/sbin
2）配置 haproxy.cfg 参数（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# cp /usr/local/haproxy/conf/haproxy.cfg /usr/local/haproxy/conf/haproxy.cfg.bak
[root@Haproxy_Keepalived_Master ~]# vim /usr/local/haproxy/conf/haproxy.cfg
global
log 127.0.0.1 local3 info #在本机记录日志
maxconn 65535 #每个进程可用的最大连接数
chroot /usr/local/haproxy #haproxy 安装目录
uid 99 #运行haproxy的用户uid（cat /etc/passwd 查看，这里是nobody的uid）
gid 99 #运行haproxy的用户组id（cat /etc/passwd 查看，这里是nobody组id）
daemon #以后台守护进程运行
defaults
log global
mode http #运行模式 tcp、 http、 health
retries 3 #三次连接失败，则判断服务不可用
option redispatch #如果后端有服务器宕机，强制切换到正常服务器
stats uri /haproxy #统计页面 URL 路径
stats refresh 30s #统计页面自动刷新时间
stats realm haproxy-status #统计页面输入密码框提示信息
stats auth admin:dxInCtFianKtL]36 #统计页面用户名和密码
stats hide-version #隐藏统计页面上 HAProxy 版本信息
maxconn 65535 #每个进程可用的最大连接数
timeout connect 5000 #连接超时
timeout client 50000 #客户端超时
timeout server 50000 #服务器端超时
frontend http-in #自定义描述信息
mode http #运行模式 tcp、 http、 health
maxconn 65535 #每个进程可用的最大连接数
bind :80 #监听 80 端口
log global
option httplog
option httpclose #每次请求完毕后主动关闭 http 通道
acl is_a hdr_beg(host) -i #规则设置，-i 后面是要访问的域名
acl is_b hdr_beg(host) -i #如果多个域名，就写多个规则，一规则对应一个域名；即后面有多个域名，就写 is_c、 is-d….，这个名字可以随意起。但要与下面的use_backend 对应
use_backend web-server if is_a #如果访问 is_a 设置的域名，就负载均衡到下面backend 设置的对应 web-server 上。web-server所负载的域名要都部署到下面的web01和web02上。如果是不同的域名部署到不同的机器上，就定义不同的web-server。
use_backend web-server if is_b
backend web-server
mode http
balance roundrobin #设置负载均衡模式，source 保存 session 值，roundrobin 轮询模式
cookie SERVERID insert indirect nocache
option httpclose
option forwardfor
server web01 182.148.15.233:80 weight 1 cookie 3 check inter 2000 rise 2 fall 5
server web02 182.148.15.238:80 weight 1 cookie 4 check inter 2000 rise 2 fall 5
注意参数解释：inter 2000 心跳检测时间；rise 2 三次连接成功，表示服务器正常；fall 5 三次连接失败，表示服务器异常； weight 1 权重设置
3）启动haproxy（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# service haproxy start #启动
[root@Haproxy_Keepalived_Master ~]# service haproxy stop #关闭
[root@Haproxy_Keepalived_Master ~]# service haproxy restart #重启
[root@Haproxy_Keepalived_Master ~]# service haproxy status #查看服务状态
4）设置HAProxy日志（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# vim /etc/rsyslog.conf
.......
$ModLoad imudp #取消注释 ，这一行不注释，日志就不会写
$UDPServerRun 514 #取消注释 ，这一行不注释，日志就不会写
.......
local0.* /var/log/haproxy.log #这一行可以没有，可以不用写
local3.* /var/log/haproxy.log #这一行必须要写
[root@Haproxy_Keepalived_Master ~]# vim /etc/sysconfig/rsyslog
SYSLOGD_OPTIONS="-r -m 0" #接收远程服务器日志
[root@Haproxy_Keepalived_Master ~]# service rsyslog restart
-------------------------------------------------------------------------------------------------------------------------
1）安装Keepalived（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_keepalived_Master ~]# yum install -y openssl-devel
[root@Haproxy_keepalived_Master ~]# cd /usr/local/src/
[root@Haproxy_keepalived_Master src]# wget /software/keepalived-1.3.5.tar.gz
[root@Haproxy_keepalived_Master src]# tar -zvxf keepalived-1.3.5.tar.gz
[root@Haproxy_keepalived_Master src]# cd keepalived-1.3.5
[root@Haproxy_keepalived_Master keepalived-1.3.5]# ./configure --prefix=/usr/local/keepalived
[root@Haproxy_keepalived_Master keepalived-1.3.5]# make && make install
[root@Haproxy_keepalived_Master keepalived-1.3.5]# cp /usr/local/src/keepalived-1.3.5/keepalived/etc/init.d/keepalived /etc/rc.d/init.d/
[root@Haproxy_keepalived_Master keepalived-1.3.5]# cp /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
[root@Haproxy_keepalived_Master keepalived-1.3.5]# mkdir /etc/keepalived/
[root@Haproxy_keepalived_Master keepalived-1.3.5]# cp /usr/local/keepalived/etc/keepalived/keepalived.conf /etc/keepalived/
[root@Haproxy_keepalived_Master keepalived-1.3.5]# cp /usr/local/keepalived/sbin/keepalived /usr/sbin/
[root@Haproxy_keepalived_Master keepalived-1.3.5]# echo "/etc/init.d/keepalived start" >> /etc/rc.local
[root@Haproxy_keepalived_Master keepalived-1.3.5]# chmod +x /etc/rc.d/init.d/keepalived #添加执行权限
[root@Haproxy_keepalived_Master keepalived-1.3.5]# chkconfig keepalived on #设置开机启动
[root@Haproxy_keepalived_Master keepalived-1.3.5]# service keepalived start #启动
[root@Haproxy_keepalived_Master keepalived-1.3.5]# service keepalived stop #关闭
[root@Haproxy_keepalived_Master keepalived-1.3.5]# service keepalived restart #重启
2）Haproxy_Keepalived_Master服务器上的Keepalived配置如下：
[root@Haproxy_Keepalived_Master ~]# cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf-bak
[root@Haproxy_Keepalived_Master ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
notification_email {
root@localhost
}
notification_email_from keepalived@localhost
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id HAproxy237
}
vrrp_script chk_haproxy { #HAproxy 服务监控脚本
script "/etc/keepalived/check_haproxy.sh"
interval 2
weight 2
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
track_script {
chk_haproxy
}
virtual_ipaddress {
182.148.15.239
}
notify_master "/etc/keepalived/clean_arp.sh 182.148.15.239"
}
vrrp_instance VI_2 {
state BACKUP
interface eth0
virtual_router_id 52
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
182.148.15.235
}
notify_master "/etc/keepalived/clean_arp.sh 182.148.15.235"
}
3）Haproxy_Keepalived_Backup服务器上的Keepalived配置如下：
[root@Haproxy_Keepalived_Backup ~]# /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf-bak
[root@Haproxy_Keepalived_Backup ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
notification_email {
root@localhost
}
notification_email_from keepalived@localhost
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id HAproxy236
}
vrrp_script chk_haproxy {
script "/etc/keepalived/check_haproxy.sh"
interval 2
weight 2
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 99
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
track_script {
chk_haproxy
}
virtual_ipaddress {
182.148.15.239
}
notify_master "/etc/keepalived/clean_arp.sh 182.148.15.239"
}
vrrp_instance VI_2 {
state MASTER
interface eth0
virtual_router_id 52
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
182.148.15.235
}
notify_master "/etc/keepalived/clean_arp.sh 182.148.15.235"
}
4）设置HAproxy服务监控脚本（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# vim /etc/keepalived/check_haproxy.sh
#!/bin/bash
A=`ps -C haproxy --no-header | wc -l`
if [ $A -eq 0 ];then
/etc/init.d/haproxy start
sleep 3
if [ `ps -C haproxy --no-header | wc -l ` -eq 0 ];then
/etc/init.d/keepalived stop
fi
fi
[root@Haproxy_Keepalived_Master ~]# chmod +x /etc/keepalived/check_haproxy.sh
5）设置更新虚拟服务器（VIP）地址的arp记录到网关脚本（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# vim /etc/keepalived/clean_arp.sh
#!/bin/sh
VIP=$1
GATEWAY=182.148.15.254 #这个是本机的外网网卡网关地址
/sbin/arping -I eth0 -c 5 -s $VIP $GATEWAY &>/dev/null
6）系统内核优化（Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup两台机器都要操作）
[root@Haproxy_Keepalived_Master ~]# echo 1024 60999 > /proc/sys/net/ipv4/ip_local_port_range
[root@Haproxy_Keepalived_Master ~]# echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
[root@Haproxy_Keepalived_Master ~]# echo 4096 > /proc/sys/net/ipv4/tcp_max_syn_backlog
[root@Haproxy_Keepalived_Master ~]# echo 262144 > /proc/sys/net/ipv4/tcp_max_tw_buckets
[root@Haproxy_Keepalived_Master ~]# echo 262144 > /proc/sys/net/ipv4/tcp_max_orphans
[root@Haproxy_Keepalived_Master ~]# echo 300 > /proc/sys/net/ipv4/tcp_keepalive_time
[root@Haproxy_Keepalived_Master ~]# echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle
[root@Haproxy_Keepalived_Master ~]# echo 0 > /proc/sys/net/ipv4/tcp_timestamps
[root@Haproxy_Keepalived_Master ~]# echo 0 > /proc/sys/net/ipv4/tcp_ecn
[root@Haproxy_Keepalived_Master ~]# echo 1 > /proc/sys/net/ipv4/tcp_sack
[root@Haproxy_Keepalived_Master ~]# echo 0 > /proc/sys/net/ipv4/tcp_dsack
7）分别启动Haproxy_Keepalived_Master 和 Haproxy_Keepalived_Backup的keealived和haproxy服务，并查看vip
[root@Haproxy_Keepalived_Master ~]# /etc/init.d/keepalived start
[root@Haproxy_Keepalived_Master ~]# /etc/init.d/haproxy start
[root@Haproxy_Keepalived_Master ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:68:dc:b6 brd ff:ff:ff:ff:ff:ff
inet 182.148.15.237/27 brd 182.148.15.255 scope global eth0
inet 182.148.15.239/32 scope global eth0
inet6 fe80::5054:ff:fe68:dcb6/64 scope link
valid_lft forever preferred_lft forever
[root@Haproxy_Keepalived_Backup ~]# /etc/init.d/keepalived start
[root@Haproxy_Keepalived_Backup ~]# /etc/init.d/haproxy start
[root@Haproxy_Keepalived_Backup ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:7c:b8:f0 brd ff:ff:ff:ff:ff:ff
inet 182.148.15.236/27 brd 182.148.15.255 scope global eth0
inet 182.148.15.235/32 scope global eth0
inet6 fe80::5054:ff:fe7c:b8f0/64 scope link
valid_lft forever preferred_lft forever
