ROS多線路負(fù)載均衡

1、PCC原理PCC從一定范圍內(nèi)分析選擇IP數(shù)據(jù)包頭，通過哈西散列算法的幫助下，將選定的區(qū)域轉(zhuǎn)換為32bit值。這個(gè)值除以指定Denominator(分母)，余數(shù)將比較一個(gè)指定的余數(shù)(Remainder),如果相等這時(shí)數(shù)據(jù)包將會(huì)被捕獲，你可以選擇src-address,dst-address,src-port,dst-port等使用此操作。per-connection-classifier=PerConnectionClassifier:=!ValuesToHash:Denominator/RemainderRemainder二=0.4294967295(integernumber)Denomin

2、ator:=1.4294967295(integernumber)ValuesToHash:=src-address|dst-address|src-port|dst-port,ValuesToHash*per-connection-classifier分類器，通過判斷源地址、目標(biāo)地址、源端口和目標(biāo)端口，對(duì)數(shù)據(jù)進(jìn)行分類，如事例：這個(gè)配置將所有連接基于源地址和端口分類的3個(gè)組：/ipfirewallmangleaddchain=preroutingaction=mark-connectionnew-connection-mark=1st_connper-connection-classifier

3、=both-addresses:3/0/ipfirewallmangleaddchain=preroutingaction=mark-connectionnew-connection-mark=2nd_connper-connection-classifier=both-addresses:3/1/ipfirewallmangleaddchain=preroutingaction=mark-connectionnew-connection-mark=3rd_connper-connection-classifier=both-addresses:3/2per-connection-classi

4、fier=both-addresses:3/0,這條規(guī)則的含義為我們對(duì)原地址的端口進(jìn)行分類，3/0為一共有3條出口，定義第一條，3/1則是第二條，以此類推。注意：PCC從RouterOSv3.24開始支持，這個(gè)功能解決了多網(wǎng)關(guān)的負(fù)載均衡問題。PCC的負(fù)載均衡事例一、雙向地址負(fù)載均衡通分組源地址和源端口實(shí)現(xiàn)負(fù)載平衡，這里我們建立2個(gè)WAN出口分別是wan1和wan2,網(wǎng)絡(luò)環(huán)境如下：ISP1地址10,200.15.99/24,網(wǎng)關(guān):;ISP2地址10,200.100.99/24,網(wǎng)關(guān)：;內(nèi)網(wǎng)IP地址192,168.100.1/24;啟用DNS緩存功能，

5、用作內(nèi)網(wǎng)DNS解析;基本配置首先進(jìn)入ipaddress配置IP地址：AddressUst+SfAddressNetworkBroadcastInterface16200.15.99/2416200.15.99/2410200.15.25510200.15.255wanl41020010099/2441020010099/24S5S5:1921681001/24192.166.100,019:1921681001/24192.166

6、.100,019 .15B.100.55lan.15B.100.55lan在ipdnssetting中配置好DNS緩存,DNS為：9源地址/目標(biāo)地址22源地址/目標(biāo)地址2/fMangle標(biāo)記配置接下來我們進(jìn)入ipfirewallmangle標(biāo)記連接和路由，我們使用per-connection-classifier雙向地址進(jìn)行分類做連接分類標(biāo)記。首先我們需要將進(jìn)入路由的的鏈接進(jìn)行標(biāo)記如下圖，我們進(jìn)入一條mangle規(guī)則，中的advanced標(biāo)簽內(nèi)容可以看到per-connection-classifier分類器，選擇both-addresses的分類：史IDNS廠DNSSet

7、tings,MangleRule*GejieralAdvancedExtraArt;onStatist!cs然后選擇dst-address-type=!local,即除了目標(biāo)地址是本地以前的地址:locallocalv vInvert.FSU一，Hotspoi*IFFraanentMangleRuleGsnerlAivancedEirtr白ActionStstisticsConnectionLimitLimiIEst.LimitNthTim電SrcAddress-Dst.TypeTypelocallocalF3DHotspot*IFFraanent注：2條線的分類代碼定義是第一條線為2/0,第

8、二條為2/1MangleRuleGeneralAdvancedEntraActionStatistics同樣選擇一下地址類型:MangleRuleGnerlAlvancedEwtr汽ActionStatisticsConnectionLimitLimiIBit.LimitNthTimeSrcAddress-Dst.AdireLZTypeType呼呼下面命令是提取走第一條線路的連接標(biāo)記取名位1st_conn,并從連接里提取路由標(biāo)記名位1st_route,設(shè)置：per-connection-classifier=both-addresses:2/0,設(shè)置in-interface=lan/ipfir

9、ewallmangleaddaction=mark-connectionchain=preroutingcomment=disabled=noin-interface=lannew-connection-mark=1st_connpassthrough=yesper-connection-classifier=both-addresses:2/0addaction=mark-routingchain=preroutingcomment=connection-mark=1st_conndisabled=noin-interface=lannew-routing-mark=1st_routepas

10、sthrough=yes提取走第二條線路的連接標(biāo)記取名位2nd_conn,并從連接里提取路由標(biāo)記名位2nd_route,設(shè)置：per-connection-classifier=both-addresses:2/1,設(shè)置in-interface=lan:/ipfirewallmangleaddaction=mark-connectionchain=preroutingcomment=disabled=noin-interface=lannew-connection-mark=2nd_connpassthrough=yesper-connection-classifier=both-addres

11、ses:2/1addaction=mark-routingchain=preroutingcomment=connection-mark=2nd_conndisabled=noin-interface=lannew-routing-mark=2nd_routepassthrough=yes在winbox在mangle中設(shè)置完成后如下：FilterRulesNATMangleServiceFortsConnectionsAddressListsLayer?Protocolsprerauting#ActionChain%In.InterfacePerConnectionClas.-.HewConn

12、ectionMarkB.一:;:;peelpeel0/markconnectionpreroutingIanbothgkddresses：2/0lst_-COUDL0BXmarkroutingprercutinglan0B；：pcc2|2j/markcoimectionprerouting1gbothaddresses：2/12nd_coim0B3/markroutingpreroiitiriglan0B回程路由設(shè)置我們需要將從那個(gè)進(jìn)入就從相應(yīng)的口回去，即保證每個(gè)外網(wǎng)口的數(shù)據(jù)能得到正確的路由/ipfirewallmangleaddchain=inputin-interface=wan1acti

13、on=mark-connectionnew-connection-mark=1st_connaddchain=inputin-interface=wan2action=mark-connectionnew-connection-mark=2nd_connwinbox設(shè)置標(biāo)記完進(jìn)入接口的鏈接后，將這些鏈接指定到相應(yīng)的路由標(biāo)記上：00ResetCounters00ResetAllCountersaddchain=outputconnection-mark=1st_connaction=mark-routingnew-routing-mark=1st_routeaddchain=outputconn

14、ection-mark=2nd_connaction=mark-routingnew-routing-mark=2nd_routewinbox設(shè)置路由配置配置完標(biāo)記后路由后，我們進(jìn)入iproute配置路由，首先設(shè)置負(fù)載均衡的標(biāo)記路由，首先設(shè)置第一條線路的路由標(biāo)記，設(shè)置routing-mark=1st_route:RouteGgmralAttributes由的式activestatiRoutingMark:RoutingMark:FrFr電電 , ,SourceSource；設(shè)置第二條線路的路由標(biāo)記，設(shè)置routing-mark=2nd_route:ScopeScope：3030TirgetSc

15、opeTirgetScope：1010Des.tma.tionDes.tma.tion：3Routedisableddisabledactivestatiactivestati配置默認(rèn)網(wǎng)關(guān)和備份網(wǎng)關(guān)，默認(rèn)網(wǎng)關(guān)的distance設(shè)置為1,并設(shè)置check-gateway=ping,通過ping監(jiān)測(cè)網(wǎng)關(guān)狀態(tài)：RouteGeneralAttriWesJdisabledJdisabledactivestatiactivestati備份網(wǎng)關(guān)的distance設(shè)置為2,并設(shè)置check-gateway=ping,通過ping監(jiān)測(cè)網(wǎng)關(guān)狀態(tài)婦RouteGemiralAttribut&sjdi.sahl

16、frdstati配置完成后的路由標(biāo)如下圖:jRouteListIkuIku皿皿RulesRulesl+.-1k,1Lil國(guó)畫皿甲DestinationGatewayGatewa.DestinationGatewayGatewa. .InterfaceDistanceRoutingMarkPref.InterfaceDistanceRoutingMarkPref.S S;默認(rèn)網(wǎng)美默認(rèn)網(wǎng)美AS10.00.0/010.200.151wuil1AS10.00.0/010.200.151wuil1；：；：替甬躲認(rèn)同美替甬躲認(rèn)同美S Spopoo.0.0/010200100o.0.0/0102001002

17、 2譚譚52522 2負(fù)載均衡標(biāo)記路由負(fù)載均衡標(biāo)記路由1 1峪峪po,0.Q,po,0.Q,0/00/010.200.15,10.200.15,1 1* *皿皿1111Ist.rouUIst.rouU；負(fù)載均衡標(biāo)記路由負(fù)載均衡標(biāo)記路由2 2ASf0ASf00 00.0.0/00/0 2火混火混1 12nd_ront2nd_ront DMDM：10.200.15.wuil0910.200.15.wuil09DM10.230.IOC.DM10.230.IOC. . .0 010.20C.10.10.20C.10. .DACp19216810.Ian01921681.DACp19216810.Ian01921681.配置nat最后配置nat轉(zhuǎn)換規(guī)則，進(jìn)入ipfirewallnat中配置action=masquerade,分別對(duì)2條線路做偽/ipfirewallnataddaction=masqueradechain=srcnatout-interface=wan1addaction