论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2012-04-21 14:28 |只看该作者 |倒序浏览

目前服务器上有两个物理上不通的两个不同网段IP地址，假设为A,B; 应用的HTTPS端口为31040，为支持通过HTTPS访问应用界面，我们做了从443端口重定向至31040，具体实现为：
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 31040

为实现不同网段情况下可以正常访问，我们通过ip rule为A添加了静态路由，并把B的网关设置默认网关。具体实现如下:

APP02:/opt/VRTSvcs/bin/cdnServiceProcess # cat /etc/APP_route
SBI_GATEWAY=xx.xx.xx.1
NBI_GATEWAY=192.168.240.1

复制代码

添加网关SHELL：

setup_route()
{
APPROUTE=/etc/APP_route
SBIGW=`awk -F= '$1=="SBI_GATEWAY"{print $2}' $APPROUTE`
NBIGW=`awk -F= '$1=="NBI_GATEWAY"{print $2}' $APPROUTE`
APPSBI=`cat /etc/hosts | grep "^[0-9]" | awk '$2=="APP-SBI" {print $1}'`
APPNBI=`cat /etc/hosts | grep "^[0-9]" | awk '$2=="APP-NBI" {print $1}'`
if [ -n "$SBIGW" ]
then
! grep SBI /etc/iproute2/rt_tables >/dev/null && echo -e "110\tSBI" >>/etc/iproute2/rt_tables
ip route del default table SBI >/dev/null 2>&1
ip route add default via $SBIGW table SBI >/dev/null 2>&1
ip rule del `ip rule list | grep 99 | awk -F: '{print $2}'|awk '{print $1,$2}'` >/dev/null 2>&1
ip rule add from $APPSBI table SBI pref 99 >/dev/null 2>&1
### Begin :add tangliting
# ip route list table main
# ip route list table SBI
#
# 增加同网段的路由到SBI表中,即使南向的网关不可达,南向IP与南向同网段的网元也能通讯
TempRow_d=/tmp/a_`date +%m.%d.hour%k`.lst
ip route list table SBI | grep link > $TempRow_d
i=1
while [ $i -le `wc -l $TempRow_d | awk '{print $1}'` ]
do
ip route del `sed -n -e "${i}p" $TempRow_d` table SBI
i=`expr $i + 1`
done
rm -f $TempRow_d
TempRow=/tmp/b_`date +%m.%d.hour%k`.lst
ip route | grep bond0 > $TempRow
i=1
while [ $i -le `wc -l $TempRow | awk '{print $1}'` ]
do
ip route add `sed -n -e "${i}p" $TempRow` table SBI
i=`expr $i + 1`
done
rm -f $TempRow
fi
### End
if [ -n "$NBIGW" ]
then
pre_bond1_gw=`route | grep default | awk '{print $2}'`
if [ -n "${pre_bond1_gw}" ]
then
for pre_bond1_gw in ${pre_bond1_gw}
do
route del default gw ${pre_bond1_gw}
done
fi
route add default gw $NBIGW > /var/log/add_cdn_gw.log 2>&1
arping -c 2 -s $APPNBI -I bond1 $NBIGW >/var/log/arping.log 2>&1
fi
}

复制代码

问题：现在通过https://A无法访问应该Web界面。其它的IP都可以正常访问。如果把默认网关设置A的网关，https://A可正常工作。
通过抓包分析来看，连接是已经到了服务器，但无法再回去了。应该是在端口redirect的时候把源地址给改了，导致回不去了。

APP02:/opt/OMC/lbin # tcpdump -i any port 443
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
09:05:34.415032 IP xxx.xxx.xxx.xxx.62529 > APP-SBI.https: S 1960056193:1960056193(0) win 64512 <mss 1460,nop,nop,sackOK>
09:05:37.329020 IP xxx.xxx.xxx.xxx.62529 > APP-SBI.https: S 1960056193:1960056193(0) win 64512 <mss 1460,nop,nop,sackOK>
09:05:43.344661 IP xxx.xxx.xxx.xxx.62529 > APP-SBI.https: S 1960056193:1960056193(0) win 64512 <mss 1460,nop,nop,sackOK>

复制代码

现在想不改变网络设置，即路由、网关的配置搞定这个问题。大神们知道怎么做不？