nginx+keepalived双机热备（外网发布）

如图案例 一，搭建2台nginx 1，系统盘安装台nginx和keepalived依赖软件

[root@centos01 ~]# yum -y install pcre-devel zlib-devel openssl-devel kernel-devel popt-devel [root@centos02 ~]# yum -y install pcre-devel zlib-devel openssl-devel kernel-devel popt-devel

2创建管理nginx用户

[root@centos02 ~]# useradd -M -s /sbin/nologin nginx [root@centos01 ~]# useradd -M -s /sbin/nologin nginx

2，linux光盘安装nginx 配置

[root@centos01 nginx-1.6.0]# ./configure --prefix=/usr/local/nginx --user=nginx --with-http_stub_status_module [root@centos01 nginx-1.6.0]# ./configure --prefix=/usr/local/nginx --user=nginx --with-http_stub_status_module

安装

[root@centos01 nginx-1.6.0]# make && make install [root@centos02 nginx-1.6.0]# make && make install

3，优化nginx命令

[root@centos01 ~]# ln -s /usr/local/nginx/sbin/nginx /usr/local/nginx/ [root@centos02 ~]# ln -s /usr/local/nginx/sbin/nginx /usr/local/nginx/

4，修改nginx网站主页

[root@centos01 ~]# echo "www.benet.com" > /usr/local/nginx/html/index.html [root@centos02 ~]# echo "www.accp.com" > /usr/local/nginx/html/index.html

5，启动nginx服务，添加开机自启

[root@centos01 ~]# nginx [root@centos02 ~]# nginx [root@centos01 ~]# vim /etc/rc.d/rc.local /usr/local/sbin/nginx [root@centos02~]# vim /etc/rc.d/rc.local /usr/local/sbin/nginx

6,客户端访问验证 二，安装keepalived 1,linux光盘配置keepalived

[root@centos01 keepalived-1.2.13]# ./configure --prefix=/ --with-kernel-dir=/usr/src/kernels && make && make install [root@centos02 keepalived-1.2.13]# ./configure --prefix=/ --with-kernel-dir=/usr/src/kernels && make && make install

2，添加为系统服务设置开机自启

[root@centos01 ~]# chkconfig --add keepalived [root@centos01 ~]# chkconfig --level 35 keepalived on [root@centos02 ~]# chkconfig --add keepalived [root@centos02 ~]# chkconfig --level 35 keepalived on

3，编辑主keepalived文件，配置监控nginx和keepalived得脚本 主配置文件

[root@centos01 ~]# vim /etc/keepalived/keepalived.conf Configuration File for keepalived global_defs { router_id Nginx_BACKUP } vrrp_instance VI_1 { state MASTER interface ens32 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.100.253 } vrrp_scrip check_nginx { script "/opt/nginx.sh" interval 2 weight 1 } }

配置监控Nginx服务和keepalived的服务控制脚本，并给予执行权限

[root@centos01 ~]# vim /opt/nginx.sh #!/bin/bash counter=$(ps -C nginx --no-heading|wc -l) if [ "${counter}" = "0" ]; then /usr/local/nginx/sbin/nginx sleep 2 counter=$(ps -C nginx --no-heading|wc -l) if [ "${counter}" = "0" ]; then /etc/init.d/keepalived stop fi fi [root@centos01 ~]# chmod +x /opt/nginx.sh

4，配置从keepalived 这里注意优先级低于主

[root@centos02 ~]# vim /etc/keepalived/keepalived.conf ! Configuration File for keepalived global_defs { router_id Nginx_Backup } vrrp_instance VI_1 { state BACKUP interface ens32 virtual_router_id 51 priority 99 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.100.253 } vrrp_scrip check_nginx { script "/opt/nginx.sh" interval 2 weight 1 } }

5，启动keepalived

[root@centos01 ~]# systemctl start keepalived [root@centos02 ~]# systemctl start keepalived

6，查看VIP地址，测试keepalived，客户端访问

[root@centos01 ~]# systemctl start keepalived

查看到VIP地址再主节点，访问的自然也是主节点网站 三，故障模拟 模拟主节点故障

[root@centos01 ~]# systemctl stop keepalived

VIP地址漂移成功 访问验证查看主节点故障，是不是访问到从节点 四，配置防火墙外网发布服务 1，启动防火墙

[root@centos03 ~]# systemctl start firewalld [root@centos03 ~]# systemctl enable firewalld

2，修改默认区域为external,把ens34接口添加进去，ens32接口添加到trusted信任区域

[root@centos03 ~]# firewall-cmd --set-default-zone=external success [root@centos03 ~]# firewall-cmd --add-interface=ens34 --zone=external [root@centos03 ~]# firewall-cmd --add-interface=ens32 --zone=trusted

3，移除默认的IP伪装，配置IP地址伪装，将内网映射到外网访问Internet

[root@centos03 ~]# firewall-cmd --remove-masquerade [root@centos03 ~]# firewall-cmd --zone=external --add-rich='rule family=ipv4 source address=192.168.100.0/24 masquerade'

4将trusted的80端口映射到防火墙外网端口

[root@centos03 ~]# firewall-cmd --zone=external --remove-rich-rule='rule family=ipv4 destination address=192.168.200.254/32 forward-port port=80 protocol=tcp to-addr=192.168.100.253'

5，external区域允许http和dns协议入站

[root@centos03 ~]# firewall-cmd --zone=external --add-service=http [root@centos03 ~]# firewall-cmd --zone=external --add-service=dns

6，客户端访问验证 五，搭建主从DNS 防火墙主DNS，Nginx主机从DNS 1,系统光盘搭建DNS

[root@centos03 ~]# yum -y install bind bind-chroot bind-utils [root@centos01 ~]# yum -y install bind bind-chroot bind-utils [root@centos02 ~]# yum -y install bind bind-chroot bind-utils

2编辑主DNS配置文件

[root@centos03 ~]# vim /etc/named.conf options { listen-on port 53 { any; }; }; zone "benet.com" IN { type master; file "benet.com.zone"; }; zone "accp.com" IN { type master; file "accp.com.zone"; }; zone "bdqn.com" IN { type master; file.bdqn.com.zone"; };

3,创建正向解析区域文件 bdqn.com.zone

$TTL 86400 @ SOA root.bdqn. root.bdqn.com( 2020031901 1H 15M 1W 1D ) @ NS centos03.bdqn.com. www A 192.168.200.254 centos03 A 192.168.200.254 ~

benet.com.zone

$TTL 86400 2020031902 @ SOA root.benet. root.benet.com( 1H 15M 1W 1D ) @ NS centos01.benet.com. www A 192.168.100.10 centos01 A 192.168.100.10 ~

accp.com.zone

$TTL 86400 2020031903 @ SOA root.accp. root.accp.com( 1H 15M 1W 1D ) @ NS centos02.accp.com. www A 192.168.100.20 centos02 A 192.168.100.20 ~

4，配置DNS从节点 两台网站服务器分别填写网关 5，两台网站服务器修改DNS配置文件

[root@centos01 ~]# vim /etc/named.conf [root@centos02 ~]# vim /etc/named.conf

6，启动DNS

[root@centos01 ~]# systemctl start named [root@centos02 ~]# systemctl start named [root@centos03 ~]# systemctl start named

7，查看区域配置文件是否复制成功 8，客户端使用域名访问