LVS+Keepalived 使用指北

[root@web1 ~]# yum install httpd* -y
[root@web1 ~]# iptables -F
[root@web1 ~]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
[root@web1 ~]# /etc/init.d/iptables stop
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
[root@web1 ~]# chkconfig iptables off
[root@web1 ~]# sed -i "s/SELINUX=enforcing/SELINUX disabled/g" /etc/selinux/config
[root@web1 ~]# setenforce 0
[root@web1 ~]# /etc/init.d/httpd start
[root@web1 ~]# ps -ef | grep httpd
root       1482      1  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1484   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1485   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1486   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1487   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1488   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1489   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1490   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
apache     1491   1482  0 18:24 ?        00:00:00 /usr/sbin/httpd
root       1494   1331  0 18:24 pts/0    00:00:00 grep httpd
[root@web1 ~]# netstat --lntup | grep 80
[root@web1 ~]# netstat -lntup | grep 80
tcp        0      0 :::80                       :::*                        LISTEN      1482/httpd
[root@web1 ~]# echo "webserver1" > /var/www/html/index.html

# LVS在3种方式下均需要打开ip_forward 功能
echo "1" > /proc/sys/net/ipv4/ip_forward
vim /etc/sysctl.conf
net.ipv4.ip_forward = 1

# 设置snat，如需永久保存可以编辑/etc/sysconfig/iptables
/sbin/iptables -t nat -A POSTROUTING -j MASQUERAD

vim /etc/sysconfig/iptables

*nat
:PREROUTING ACCEPT [6:504]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:52]
:POSTROUTING ACCEPT [1:52]
# SNAT
-A POSTROUTING -j MASQUERADE
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# 配置外网白名单
-A INPUT -s 180.168.36.198 -j ACCEPT 
-A INPUT -s 180.168.34.218 -j ACCEPT 
-A INPUT -s 222.73.202.251 -j ACCEPT 
# 控制端口
-A INPUT -p tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp --dport 22 -j ACCEPT
# For keepalived
# allow vrrp
-A INPUT -p vrrp -j ACCEPT
-A INPUT -p igmp -j ACCEPT
# allow multicast
-A INPUT -d 224.0.0.18 -j ACCEPT
# 配置内网白名单
-A INPUT -s 10.0.0.0/8 -j ACCEPT
-A INPUT -s 172.16.0.0/12 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -j ACCEPT
# 开放本地和Ping
-A INPUT -i lo -j ACCEPT  
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT
# 拒绝其它
-A INPUT -j DROP 
-A FORWARD -j DROP 
# 开放出口
-A OUTPUT -j ACCEPT 
COMMIT


# 重启生效
service iptables restart
# 复查结果
iptables -nvL

# 安装ipvsadm

[root@LVS ~]# yum install ipvsadm* -y
[root@LVS ~]# lsmod | grep lv_
[root@LVS ~]# lsmod | grep ip_vs
ip_vs_rr                1420  0 
ip_vs                 126897  2 ip_vs_rr
libcrc32c               1246  1 ip_vs
ipv6                  336282  270 ip_vs,ip6t_REJECT,nf_conntrack_ipv6,nf_defrag_ipv6

# 配置脚本如下

#!/bin/bash

VIP=192.168.10.10 #外网用户直接访问网站的IP地址
RIP1=192.168.84.104 #后端web1服务器的IP地址
RIP2=192.168.84.105 #后端web2服务器的IP地址

case "$1" in
start)
    echo "Start LVS as the mode NAT"
    echo "1" > /proc/sys/net/ipv4/ip_forward #开启LVS服务器的IP路由转发功能
    /sbin/ifconfig eth0:0 $VIP netmask 255.255.255.0 up #设定VIP地址
    /sbin/ipvsadm -A -t $VIP:80 -s rr
    /sbin/ipvsadm -a -t $VIP:80 -r $RIP1 -m
    /sbin/ipvsadm -a -t $VIP:80 -r $RIP2 -m
    /sbin/ipvsadm 
    ;;
stop)
    echo "Stop LVS"
    echo "0" > /proc/sys/net/ipv4/ip_forward
    /sbin/ifconfig eth0:0 down
    ;;
*)  
    echo "Usage:$0 {start|stop}"
    exit 1
esac

# 运行脚本后结果如下

[root@LVS ~]# sh lvs_nat.sh start
Start LVS as the mode NAT
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  192.168.10.10:http rr
  -> 192.168.84.104:http          Masq    1      0          0         
  -> 192.168.84.105:http          Masq    1      0          0 

# web服务器需要删除默认的路由网关，重新设置路由网关为LVS主机IP地址

[root@web1 ~]# route del default
[root@web1 ~]# route add default gateway 192.168.84.103
[root@web1 ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.84.0    *               255.255.255.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     1002   0        0 eth0
default         192.168.84.103  0.0.0.0         UG    0      0        0 eth0

# 通过curl命令查看是否成功

[root@LVS ~]# curl 192.168.10.10
webserver2
[root@LVS ~]# curl 192.168.10.10
webserver1
[root@LVS ~]# curl 192.168.10.10
webserver2
[root@LVS ~]# curl 192.168.10.10
webserver1
[root@LVS ~]# curl 192.168.10.10
webserver2
[root@LVS ~]# curl 192.168.10.10
webserver1

# LVS-DR RealServer服务器脚本，由于VS/DR工作原理，Realserver 需要抑制arp广播 

#!/bin/bash 
VIP=192.168.84.200 
/etc/rc.d/init.d/functions 
case "$1" in 
start) 
           echo "start LVS of RealServer DR" 
           /sbin/ifconfig lo:0 $VIP broadcast $VIP netmask 255.255.255.255 up 
           /sbin/route add -host $VIP dev lo:0  
           echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore 
           echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce 
           echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore 
           echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce  
       ;; 
stop) 
           /sbin/ifconfig lo:0 down 
           echo "close LVS of RealServer DR" 
           echo "0" >/proc/sys/net/ipv4/conf/lo/arp_ignore 
           echo "0" >/proc/sys/net/ipv4/conf/lo/arp_announce 
           echo "0" >/proc/sys/net/ipv4/conf/all/arp_ignore 
           echo "0" >/proc/sys/net/ipv4/conf/all/arp_announce 
           ;; 
  
*) 
          echo "Usage: $0 {start|stop}" 
          exit 1 
esac  
exit 0 

# Lvs-DR 启动脚本

#!/bin/bash 
VIP=192.168.84.200 
RIP1=192.168.84.104 
RIP2=192.168.84.105
/etc/rc.d/init.d/functions 
case "$1" in 
start) 
           echo "start LVS of DirectorServer DR" 
           /sbin/ifconfig eth0:0 $VIP broadcast $VIP netmask 255.255.255.255 up 
           /sbin/route add -host $VIP dev eth0:0 
           echo "1" >/proc/sys/net/ipv4/ip_forward 
           /sbin/ipvsadm -C 
           /sbin/ipvsadm -A -t $VIP:80 -s rr  
           /sbin/ipvsadm -a -t $VIP:80 -r $RIP1:80 -g 
           /sbin/ipvsadm -a -t $VIP:80 -r $RIP2:80 -g 
           /sbin/ipvsadm 
       ;; 
stop) 
           echo "stop LVS of DirectorServer DR" 
           echo "0" >/proc/sys/net/ipv4/ip_forward 
           /sbin/ipvsadm -C 
           /sbin/ifconfig eth0:0 down 
           ;; 
*) 
          echo "Usage: $0 {start|stop}" 
          exit 1 
esac 
exit 0

# 每台realserver index.html文件内容为ip 地址，例如： 
echo "172.27.233.43" > /var/www/html/index.html
echo "172.27.233.44" > /var/www/html/index.html

# 启动http服务
/etc/init.d/httpd start

# 客户端模拟请求
for((i=1;i<=10;i++));do curl http://172.27.233.45/; done
172.27.233.44 
172.27.233.43 
172.27.233.44 
172.27.233.43 
172.27.233.44 
172.27.233.43 
172.27.233.44 
172.27.233.43 
172.27.233.44 
172.27.233.43 

# 请求分配结果
ipvsadm -Ln --stats
IP Virtual Server version 1.2.1 (size=4096) 
Prot LocalAddress:Port               Conns   InPkts  OutPkts  InBytes OutBytes 
  -> RemoteAddress:Port 
TCP  172.27.233.45:80                   10      50        0     4330        0 
  -> 172.27.233.43:80                    5       25        0     2165        0 
  -> 172.27.233.44:80                    5       25        0     2165        0 

参数含义 
--stats 显示统计信息 
Prot LocalAddress:Port Conns InPkts OutPkts InBytes OutBytes 
                       连接数 输入包 输出包 输入流量 输出流量

# 全局定义(global definition) 
global_defs {                      
   notification_email {      
   acassen@firewall.loc     
   failover@firewall.loc
   sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc   
   smtp_server 192.168.200.1                         
   smtp_connect_timeout 30                                  
   router_id LVS_DEVEL     
}
notification_email: 表示keepalived在发生诸如切换操作时需要发送email通知以及email发送给哪些邮件地址邮件地址可以多个每行一个
notification_email_from admin@example.com: 表示发送通知邮件时邮件源地址是谁
smtp_server 127.0.0.1: 表示发送email时使用的smtp服务器地址这里可以用本地的sendmail来实现
smtp_connect_timeout 30: 连接smtp连接超时时间
router_id node1: 机器标识，通常配置主机名

# 静态地址和路由配置范例
static_ipaddress {
    192.168.1.1/24 brd + dev eth0 scope global
    192.168.1.2/24 brd + dev eth1 scope global
}
static_routes {
    src $SRC_IP to $DST_IP dev $SRC_DEVICE
    src $SRC_IP to $DST_IP via $GW dev $SRC_DEVICE
}
这里实际上和系统里面命令配置IP地址和路由一样例如
192.168.1.1/24 brd + dev eth0 scope global 相当于: ip addr add 192.168.1.1/24 brd + dev eth0 scope global
就是给eth0配置IP地址路由同理,一般这个区域不需要配置
这里实际上就是给服务器配置真实的IP地址和路由的在复杂的环境下可能需要配置一般不会用这个来配置我们可以直接用vi /etc/sysconfig/network-script/ifcfg-eth1来配置切记这里可不是VIP不要搞混淆了切记切记

# VRRP同步组(synchroization group)配置范例
vrrp_sync_group VG_1 {   //注意vrrp_sync_group  后面可自定义名称如lvs_httpd ,httpd
group {
http
mysql
}
notify_master /path/to/to_master.sh
notify_backup /path_to/to_backup.sh
notify_fault "/path/fault.sh VG_1"
notify /path/to/notify.sh
smtp_alert 
}
其中http和mysql是实例名和下面的实例名一致
notify_master /path/to/to_master.sh //表示当切换到master状态时要执行的脚本
notify_backup /path_to/to_backup.sh //表示当切换到backup状态时要执行的脚本
notify_fault "/path/fault.sh VG_1"  // keepalived出现故障时执行的脚本
notify /path/to/notify.sh  
smtp_alert           //表示切换时给global defs中定义的邮件地址发送邮件通知

# VRRP实例(instance)配置范例
vrrp_instance http {  //注意vrrp_instance 后面可自定义名称如lvs_httpd ,httpd
state MASTER
interface eth0
dont_track_primary
track_interface {
eth0
eth1
}
mcast_src_ip <IPADDR>
garp_master_delay 10
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
autp_pass 1234
}
virtual_ipaddress {
#<IPADDR>/<MASK> brd <IPADDR> dev <STRING> scope <SCOPT> label <LABEL>
192.168.200.17/24 dev eth1
192.168.200.18/24 dev eth2 label eth2:1
}
virtual_routes {
# src <IPADDR> [to] <IPADDR>/<MASK> via|gw <IPADDR> dev <STRING> scope <SCOPE> tab
src 192.168.100.1 to 192.168.109.0/24 via 192.168.200.254 dev eth1
192.168.110.0/24 via 192.168.200.254 dev eth1
192.168.111.0/24 dev eth2
192.168.112.0/24 via 192.168.100.254
}
nopreempt
preemtp_delay 300
debug
}

# VRRP脚本
# 如下所示为相关配置示例
vrrp_script check_running {
   script "/usr/local/bin/check_running"
   interval 10
   weight 10
}

vrrp_instance http {
   state BACKUP
   smtp_alert
   interface eth0
   virtual_router_id 101
   priority 90
   advert_int 3
   authentication {
   auth_type PASS
   auth_pass whatever
   }
   virtual_ipaddress {
   1.1.1.1
   }
   track_script {
   check_running 
   }
}
# 首先在vrrp_script区域定义脚本名字和脚本执行的间隔和脚本执行的优先级变更,如下所示:
vrrp_script check_running {
            script "/usr/local/bin/check_running"
            interval 10     #脚本执行间隔
            weight 10       #脚本结果导致的优先级变更10表示优先级+10-10则表示优先级-10
            }
# 然后在实例(vrrp_instance)里面引用有点类似脚本里面的函数引用一样先定义后引用函数名
track_script {
      check_running 
}

#HTTP/HTTPS方式 
HTTP_GET|SSL_GET {      #设置健康检查方式

url {                   #设置要检查的URL可以有多个
path /                  #设置URL具体路径
digest <STRING>         #检查后的摘要信息这些摘要信息可以通过genhash命令 工具 获取                                   
status_code 200         #设置返回状态码
}
connect_port 80         #设置监控检查的端口
bindto  <IPADD>         #设置健康检查的IP地址
connect_timeout   3     #设置连接超时时间
nb_get_retry  3         #设置重连次数
delay_before_retry  2   #设置重连间隔
} 

#TCP方式  
TCP_CHECK     {
connect_port 80         #设置监控检查的端口
bindto  <IPADD>         #设置健康检查的IP地址
connect_timeout   3     #设置连接超时时间
nb_get_retry  3         #设置重连次数
delay_before_retry  2   #设置重连间隔
}
#SMTP方式 (这个可以用来给邮件服务器做集群)
SMTP_CHECK {
host {
connect_ip <IP ADDRESS>
connect_port <PORT>     #默认检查25端口
14 KEEPALIVED
bindto <IP ADDRESS>
}
connect_timeout <INTEGER>
retry <INTEGER>
delay_before_retry <INTEGER>
helo_name <STRING>|<QUOTED-STRING>
} 

#MISC方式 这个可以用来检查很多服务器只需要自己会些脚本即可
MISC_CHECK {
misc_path <STRING>|<QUOTED-STRING>  #外部程序或脚本
misc_timeout <INT>                  #脚本或程序执行超时时间
misc_dynamic                                              
#这个就很好用了可以非常精确的来调整权重是后端每天服务器的压力都能均衡调配这个主要是通过执行的程序或脚本返回的状态代码来动态调整weight值使权重根据真实的后端压力来适当调整不过这需要有过硬的脚本功夫才行哦
#返回0健康检查没问题不修改权重
#返回1健康检查失败权重设置为0
#返回2-255健康检查没问题但是权重却要根据返回代码修改为返回码-2例如如果程序或脚本执行后返回的代码为200#那么权重这回被修改为 200-2
}

# 关闭防火墙
systemctl disable firewalld
systemctl stop firewalld

# 禁用selinux
setenforce 0
vi /etc/selinux/config

SELINUX=disabled

# 安装keepalived,ipvsadm
yum install keepalived ipvsadm -y

# 开启LVS服务器的IP路由转发功能
echo "1" > /proc/sys/net/ipv4/ip_forward
# 添加路由转发至sysctl.conf
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1

# 编辑keepalived配置文件
vi /etc/keepalived/keepalived.conf

vrrp_sync_group VI_GOP_NC1_LB1 {
    group {
        VI_VI_GOP_NC1_LB1_1
        VI_VI_GOP_NC1_LB1_2
    }
}

vrrp_instance VI_VI_GOP_NC1_LB1_1 {
    state BACKUP
    interface bond0
    virtual_router_id 28
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.65.32.28/23 dev bond0
    }
}

vrrp_instance VI_VI_GOP_NC1_LB1_2 {
    state BACKUP
    interface bond0
    virtual_router_id 29
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.65.32.29/23 dev bond0
    }
}

# Install keepalived
# Ubuntu
apt-get install keepalived ipvsadm
# CentOS
yum install keepalived ipvsadm
# mod iptables
vim /etc/sysconfig/iptables

# LVS configuration
## For keepalived:
### allow vrrp (112)
-A INPUT -p vrrp -j ACCEPT
-A INPUT -p igmp -j ACCEPT
### allow multicast
-A INPUT -d 224.0.0.18 -j ACCEPT

# restart iptables
service iptables restart


# example
# two vip for lvs-dr

vrrp_sync_group GOP {
    group {
        VI_PRI_CONNECT
        VI_PRI_AUTH
    }
}

vrrp_instance VI_PRI_CONNECT {
    state BACKUP
    interface bond0
    virtual_router_id 128
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.65.32.28/23 dev bond0
    }
}

virtual_server 10.65.32.28 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    protocol TCP

    real_server 10.65.32.13 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 10.65.32.14 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 10.65.32.15 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 10.65.32.16 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 10.65.32.17 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 10.65.32.18 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
}

virtual_server 10.65.32.28 443 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    protocol TCP

    real_server 10.65.32.13 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 10.65.32.14 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 10.65.32.15 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 10.65.32.16 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 10.65.32.17 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 10.65.32.18 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
}

vrrp_instance VI_PRI_AUTH {
    state BACKUP
    interface bond0
    virtual_router_id 129
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        10.65.32.29/23 dev bond0
    }
}

virtual_server 10.65.32.29 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    protocol TCP

    real_server 10.65.32.22 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
    real_server 110.65.32.23 80 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 80
        }
    }
}

virtual_server 10.65.32.29 443 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    protocol TCP

    real_server 10.65.32.22 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
    real_server 110.65.32.23 443 {
        weight 100
        TCP_CHECK {
                connect_timeout 3
                nb_get_retry 3
                delay_before_retry 3
                connect_port 443
        }
    }
}


# enable and start keepalived
systemctl start keepalived
systemctl enable keepalived
watch ipvsadm -L -n --stats

# add TYPE=Loopback
echo "TYPE=Loopback" >> /etc/sysconfig/network-scripts/ifcfg-lo
# add ifcfg-lo:0
cat > /etc/sysconfig/network-scripts/ifcfg-lo:0 << EOF
DEVICE=lo:0
IPADDR=10.65.32.28
NETMASK=255.255.255.255
ONBOOT=yes
EOF

# ifup lo:0
ifup lo:0

# add real_start
cat > /root/real_start.sh << EOF
#!/bin/bash
echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce
echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore
echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce
EOF

# chmod 755
chmod 755 /root/real_start.sh

# add real.service
cat > /usr/lib/systemd/system/real.service << EOF
[Unit]
Description=autostart lvs real
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
ExecStart=/root/real_start.sh

[Install]
WantedBy=multi-user.target
EOF

# enable service
systemctl enable real.service


# lvs real server example
vim /root/lvs_real.sh

#!/bin/bash
### BEGIN INIT INFO
# Provides:
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start realserver
# Description:       Start realserver
### END INIT INFO

# change the VIP to proper value
VIP=10.65.32.28

case "$1" in
    start)

    echo "Start REAL Server"
    /sbin/ifconfig lo:0 $VIP broadcast $VIP netmask 255.255.255.255 up
    echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore
    echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce
    echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore
    echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce

    ;;

    stop)

    /sbin/ifconfig lo:0 down
    echo "Stop REAL Server"
    echo "0" >/proc/sys/net/ipv4/conf/lo/arp_ignore
    echo "0" >/proc/sys/net/ipv4/conf/lo/arp_announce
    echo "0" >/proc/sys/net/ipv4/conf/all/arp_ignore
    echo "0" >/proc/sys/net/ipv4/conf/all/arp_announce

    ;;

    restart)

    $0 stop
    $0 start

    ;;

    *)

    echo "Usage: $0 {start|stop}"
    exit 1

    ;;
esac

exit 0

[root@sg-gop-10-65-32-35 wangao]# arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
10.65.32.31              ether   48:8e:ef:7b:c6:0a   C                     bond0
10.65.32.83              ether   50:5d:ac:ed:89:dd   C                     bond0
10.65.32.254             ether   00:00:0c:9f:f0:ec   C                     bond0
10.65.32.252             ether   bc:16:65:68:07:81   C                     bond0
10.65.32.34              ether   50:1d:93:f5:eb:97   C                     bond0
10.65.32.8               ether   48:8e:ef:7c:0a:8d   C                     bond0
10.65.32.253             ether   18:e7:28:97:e5:01   C                     bond0
[root@sg-gop-10-65-32-35 wangao]# arp -d 10.65.32.31
[root@sg-gop-10-65-32-35 wangao]#
[root@sg-gop-10-65-32-35 wangao]#
[root@sg-gop-10-65-32-35 wangao]# telnet 10.65.32.31 12100
Trying 10.65.32.31...
Connected to 10.65.32.31.
Escape character is '^]'.

[root@sg-gop-10-65-32-35 wangao]# arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
10.65.32.31              ether   48:8e:ef:7b:c7:5a   C                     bond0
10.65.32.70              ether   00:2e:c7:3a:a5:b5   C                     bond0
10.65.32.83              ether   50:5d:ac:ed:89:dd   C                     bond0
10.65.32.254             ether   00:00:0c:9f:f0:ec   C                     bond0
10.65.32.252             ether   bc:16:65:68:07:81   C                     bond0
10.65.32.34              ether   50:1d:93:f5:eb:97   C                     bond0
10.65.32.8               ether   48:8e:ef:7c:0a:8d   C                     bond0
10.65.32.253             ether   18:e7:28:97:e5:01   C                     bond0