1473云系统
搜索

有思俱乐部学习园地

nginx配置负载均衡和反向代理

前期准备：

nginx反向代理配置介绍 

1台Windows 7做访问测试
1台Windows server 
2台nodejs
1台ubuntu做nginx（双网卡）
本实例均可根据实例做改动

Windows server（172.16.16.100）利用IIS在80端口挂载了一个推箱子的网页
Nodejs1 （172.16.16.3），Nodejs2	(172.16.16.4)在8100端口挂载了网页

DMZ:

1配置双网卡

2.DMZ配置防火墙（Windows的出入站策略）

新建一个iptables.rule的文件； 

#!/bin/bash
#1,input parameters
EXTIF="ens160"		#出站网卡
INIF="ens192"		#入站网卡
EXTIP="10.3.14.126"	#出站ip
INNET="172.16.16.0/24"	#入站ip

#2,linux kernel network function
echo "1"> /proc/sys/net/ipv4/tcp_syncookies
echo "1"> /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/rp_filter;do
    echo "1">$i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians;do
    echo "1">$i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
    echo "0">$i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects;do 
   echo "0">$i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects;do
   echo "0">$i
done

#3,clear rules init eth
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT

#3.1  allow nat internet
iptables -A FORWARD -i $INIF -j ACCEPT

#4,start other iptables modules
if [ -f /root/iptables/iptables.deny ];then
    sh /root/iptables/iptables.deny
fi
if [ -f /root/iptables/iptables.allow ];then
    sh /root/iptables/iptables.allow
fi
if [ -f /usr/local/virus/httpd-err/iptables.http ];then
    sh /usr/local/virus/httpd-err/iptables.http
fi
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

#5,allow some type icmp data in
AICMP="0 3 3/4 4 8 11 12 14 16 18"
for tyicmp in $AICMP
do
    iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
done

#开放部分端口
#6,allow some services in
iptables -A INPUT -p TCP -i $EXTIF --dport 1221 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 3000 -j ACCEPT
#iptables -A INPUT -p TCP -i $EXTIF --dport 53 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 80 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 25 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 110 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 3306 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 443 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 8080 -j ACCEPT

#7,load some useful modules
modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do 
    testmod=`lsmod | grep "^$(mod)" | awk '{print $1}'`
    if [ "$testmod" == "" ];then
          modeprobe $mod
    fi
done

#8 clear nat tables rule
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

#9 open for router  ip share
if [ "$INIF" != "" ];then
	iptables -A INPUT -i $INIF -j ACCEPT
	echo "1" > /proc/sys/net/ipv4/ip_forward
	if [ "$INNET" != "" ];then
		for innet in $INNET
		do 
			iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
		done
	fi 
fi

#F
#端口映射
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8085 -j DNAT --to 172.16.16.100:3389
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8086 -j DNAT --to 172.16.16.100:80
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8081 -j DNAT --to 172.16.16.2:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8082 -j DNAT --to 172.16.16.3:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8083 -j DNAT --to 172.16.16.2:80
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8084 -j DNAT --to 172.16.16.3:8100
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8087 -j DNAT --to 172.16.16.4:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 8088 -j DNAT --to 172.16.16.4:8100

以最后一句为例，意思为

22和3389分别是SSH和server的远程端口

将DMZ的8088端口映射到172.16.16.4:8100（nodejs1的8100端口上）

执行文件， 

sh /iptables.rule //iptable.rule文件的目录
/*
	将命令添加到vi /etc/rc.local下可以开机自启
*/

3.配置完IPtable后，将server和nodejs的ip改为172.16.16.0/24，网卡改为172.16.16.1
Ping www.baidu.com可以访问则表示成功

4.安装Nginx 

apt-get update
apt-get install nginx

5.配置反向代理，与负载均衡 

vi /etc/nginx/siten_enable/default

把原本的都注释掉插入以下配置信息#可以实际情况做改动 

upstream iisserver{
    server 172.16.16.100:80 weight=1 max_fails=2 fail_timeout=50s;
}
upstream nodejs{
    server 172.16.16.3:8100 weight=1 max_fails=2 fail_timeout=50s;
	server 172.16.16.4:8100 weight=1 max_fails=2 fail_timeout=50s;
}

server {
        listen 80 ;
        server_name nodejs.1473.com;
	 location / 
	{
		proxy_pass http://nodejs;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $remote_addr;
	}
}

server {
	listen 80 ;
	server_name iis.1473.com;

		location / {

		proxy_pass http://iisserver;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-For $remote_addr;

}
\

6.在Windows7的host文件中

域名重定向

访问iis.1473.com会出现

访问nodejs.1473.com则出现

或者

成功！！！！

工作人员

 

作者：陈浩杰 


信息录入:刘明欣