HAProxy反向代理负载均衡实例

1、环境准备：

2、安装后端web服务器

#web服务器（10.0.0.18、10.0.0.28）：
[root@rocky8 ~]#yum install -y nginx
[root@rocky8 ~]#echo `hostname -I` > /usr/share/nginx/html/index.html

3、配置HAProxy

[root@ubuntu2004 ~]#bash install_haproxy.sh        #脚本参见：https://blog.51cto.com/dayu/5795076
[root@ubuntu2004 ~]#vim /usr/lib/systemd/system/haproxy.service
ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/conf.d/ -c -q
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/conf.d/  -p /var/lib/haproxy/haproxy.pid

#证书制作
[root@ubuntu2004 ~]#mkdir /etc/haproxy/certs
[root@ubuntu2004 ~]#cd /etc/haproxy/certs
[root@ubuntu2004 certs]#openssl genrsa -out www.wang.org.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.......................+++++
.+++++
e is 65537 (0x010001)
[root@ubuntu2004 certs]#openssl req -x509 -newkey rsa:2048 -subj "/CN=www.wang.org" -keyout www.wang.org.key -nodes -days 3650 -out www.wang.org.crt
Generating a RSA private key
........................+++++
......................................+++++
writing new private key to 'www.wang.org.key'
-----
[root@ubuntu2004 certs]#cat www.wang.org.key www.wang.org.crt > www.wang.org.pem

# 配置Https
[root@ubuntu2004 ~]#vim /etc/haproxy/conf.d/ha_test.cfg
frontend http_80
    bind 172.20.0.248:80
    bind 172.20.0.248:443 ssl crt /etc/haproxy/certs/www.wang.org.pem
    redirect scheme https if !{ ssl_fc }
    http-request set-header X-forwarded-Port %[dst_port]
    http-request add-header X-forwarded-proto https if { ssl_fc }

    mode http
    balance roundrobin
    log global
    option httplog
    use_backend servers

backend servers
    mode http
    server web01 10.0.0.18:80 check inter 3000 fall 3 rise 3
    server web02 10.0.0.28:8008 check inter 3000 fall 3 rise 3

4、配置DNS

[root@ubuntu2004 ~]#apt install bind9 bind9-utils

[root@ubuntu2004 ~]#vim /etc/bind/named.conf.options
//  dnssec-validation auto;      #注释

[root@ubuntu2004 ~]#cd /etc/bind/
[root@ubuntu2004 bind]#vim named.conf.default-zones
zone "wang.org" {
    type master;
    file "/etc/bind/wang.org.zone";
};
[root@ubuntu2004 bind]#cp -p db.local wang.org.zone
$TTL    604800
@   IN  SOA admin admin.wang.org. (
                  2     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
@   IN  NS  admin
admin   IN  A   172.20.0.247
www     IN  A   172.20.0.248
[root@ubuntu2004 bind]#systemctl restart bind9.service 
[root@ubuntu2004 bind]#dig www.wang.org @127.0.0.1
......
;; ANSWER SECTION:
www.wang.org.        604800    IN    A    172.20.0.248
......

5、客户端测试

[root@rocky8 ~]#vim /etc/resolv.conf
nameserver 172.20.0.247
[root@rocky8 ~]#curl -Lk  www.wang.org
10.0.0.28
[root@rocky8 ~]#curl -Lk  www.wang.org
10.0.0.18
[root@rocky8 ~]#curl -Lk  www.wang.org
10.0.0.28
[root@rocky8 ~]#curl -Lk  www.wang.org
10.0.0.18