IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn TCP 192.168.195.200:22 wlc persistent 360 TCP 192.168.195.200:80 wlc persistent 360 -> 192.168.195.170:80 Route 1 0 0 -> 192.168.195.171:80 Route 3 0 0
pcc
IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn TCP 192.168.195.200:0 wlc persistent 360 -> 192.168.195.170:0 Route 1 0 0 -> 192.168.195.171:0 Route 3 0 0
[root@nod1 CA]# (umask 077; openssl genrsa 2048 > ../private/cakey.pem) [root@nod1 CA]# openssl req -new -x509 -key private/cakey.pem -days 3650 -out certs/cacert.pem [root@nod1 CA]# touch index.txt serial [root@nod1 CA]# echo 00 > serial
httpd 制作签署请求
[root@nod2 httpd]# (umask 077; openssl genrsa 1024 > conf/httpd.key) [root@nod2 httpd]# openssl req -new -key conf/httpd.key -out conf/httpd.csr
CA签署
[root@nod1 CA]# scp 192.168.195.170:/etc/httpd/conf/httpd.csr /tmp [root@nod1 CA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650 [root@nod1 CA]# scp /tmp/httpd.crt 192.168.195.170:/etc/httpd/conf
安装httpd 的 ssl module,并且配置启用https
[root@nod2 httpd]# yun install mod_ssl [root@nod2 httpd]# vim /etc/httpd/conf.d/ssl.conf 添加如下2行 SSLCertificateFile /etc/httpd/conf/httpd.crt SSLCertificateKeyFile /etc/httpd/conf/httpd.key
重启并验证https
tcp 0 0 :::80 :::* LISTEN tcp 0 0 :::443 :::* LISTEN
报文打标
[root@nod1 ~]# iptables -t mangle -A PREROUTING -d 192.168.195.200 -p tcp --dport 80 -j MARK --set-mark 10 [root@nod1 ~]# iptables -t mangle -A PREROUTING -d 192.168.195.200 -p tcp --dport 443 -j MARK --set-mark 10
规则生成
[root@nod1 ~]# ipvsadm -A -f 10 -s wlc -p [root@nod1 ~]# ipvsadm -a -f 10 -r 192.168.195.170 -g -w 1 [root@nod1 ~]# ipvsadm -a -f 10 -r 192.168.195.171 -g -w 1 [root@nod1 ~]# ipvsadm -ln IP Virtual Server version 1.2.1 (size=4096) Prot LocalAddress:Port Scheduler Flags -> RemoteAddress:Port Forward Weight ActiveConn InActConn FWM 10 wlc persistent 360 -> 192.168.195.170:0 Route 1 0 0 -> 192.168.195.171:0 Route 1 0 0