{"id":4753,"date":"2019-08-20T18:45:35","date_gmt":"2019-08-20T21:45:35","guid":{"rendered":"https:\/\/blog.clusterweb.com.br\/?p=4753"},"modified":"2019-08-20T18:45:35","modified_gmt":"2019-08-20T21:45:35","slug":"balanceando-links-de-internet-no-linux","status":"publish","type":"post","link":"https:\/\/blog.clusterweb.com.br\/?p=4753","title":{"rendered":"Balanceando links de internet no linux"},"content":{"rendered":"

Em um projeto recente precisei fazer o balanceamento de links no linux, o cliente possu\u00eda sa\u00edda por dois provedores, sendo o primeiro NET\/Virtua e o segundo Embratel, seu link Embratel estava ocioso e ele queria acabar com essa ociosidade.<\/p>\n

A solu\u00e7\u00e3o foi usar o iproute2 para criar uma tabela com balanceamento de links para alguns pacotes, em conjunto usei o iptables para marcar os pacotes que deveriam sair por essa tabela.<\/p>\n

Al\u00e9m disto o cliente usava o Embratel para alguns servi\u00e7os, logo existia um redirecionamento DNAT para rede interna e isso precisava ser levado em conta.<\/p>\n

Vamos a solu\u00e7\u00e3o para essa necessidade.<\/p>\n

Ambiente<\/h2>\n

Vamos descrever as configura\u00e7\u00f5es de rede do ambiente<\/p>\n

Interface eth0 est\u00e1 com rede interna (10.1.x.x\/xx)\r\nInterface eth1 est\u00e1 conectado ao modem virtua (189.x.x.x)\r\nInterface eth2 est\u00e1 conectado ao modem embratel (200.x.x.x)\r\n<\/code><\/pre>\n
Se isto est\u00e1 entendido, vamos continuar.<\/p>\n
<\/p>\n
Procedimento manual<\/h2>\n
1. Criando tabelas no rt_tables<\/h3>\n
Primeiro edite o arquivo<\/p>\n
vim \/etc\/iproute2\/rt_tables\r\n<\/code><\/pre>\n
E adicione as seguintes tabelas ao final do arquivo<\/p>\n
20 VIRTUA\r\n30 EMBRATEL\r\n40 BALANCEAMENTO\r\n<\/code><\/pre>\n
\u00d3timo, isso \u00e9 suficiente, elas precisam existir para que possamos criar regras em cada uma destas tabelas.<\/p>\n
2. Criando regras no iproute2<\/h3>\n
2.1 configurando tabela virtua<\/h4>\n
Antes de come\u00e7ar, vou colocar nomes ao inv\u00e9s de endere\u00e7os IPs para facilitar o entendimento, veja o que significa cada coisa.<\/p>\n
VIRTUA_NET \u00e9 o endere\u00e7o de rede\r\nVIRTUA_NIC \u00e9 a placa de rede (eth1)\r\nVIRTUA_GAT \u00e9 o endere\u00e7o do GW virtua\r\nVIRTUA_IPA \u00e9 o ip da VIRTUA_NIC\r\n<\/code><\/pre>\n
Vamos a configura\u00e7\u00e3o b\u00e1sica da tabela virtua<\/p>\n
ip route add VIRTUA_NET dev VIRTUA_NIC src VIRTUA_IPA table VIRTUA\r\n<\/code><\/pre>\n
Agora vamos especificar quem \u00e9 o defautl gateway da virtua<\/p>\n
ip route add default via VIRTUA_GAT table VIRTUA\r\n<\/code><\/pre>\n
2.2 configurando tabela embratel<\/h4>\n
Novamente eu vou colocar nomes ao inv\u00e9s de endere\u00e7os IPs para facilitar o entendimento, veja o que significa cada coisa.<\/p>\n
EMBRATEL_NET \u00e9 o endere\u00e7o de rede\r\nEMBRATEL_NIC \u00e9 a placa de rede (eth1)\r\nEMBRATEL_GAT \u00e9 o endere\u00e7o do GW\r\nEMBRATEL_IPA \u00e9 o ip da EMBRATEL_NIC\r\n<\/code><\/pre>\n
Agora vamos configurar a tabela EMBRATEL<\/p>\n
ip route add EMBRATEL_NET dev EMBRATEL_NIC src EMBRATEL_IPA table EMBRATEL\r\n<\/code><\/pre>\n
Defina o gateway padr\u00e3o da tabela EMBRATEL<\/p>\n
ip route add default via EMBRATEL_GAT table EMBRATEL\r\n<\/code><\/pre>\n
2.3 configurando tabela balanceamento<\/h4>\n
Agora vamos criar a tabela que far\u00e1 o balanceamento entre os dois links<\/p>\n
ip route add default scope global table BALANCEAMENTO nexthop via VIRTUA_GAT dev VIRTUA_NIC weight 2 nexthop via EMBRATEL_GAT dev EMBRATEL_NIC weight 1\r\n<\/code><\/pre>\n
Pronto, configuramos a tabela BALANCEAMENTO.<\/p>\n
Veja que o peso do VIRTUA \u00e9 maior que o EMBRATEL, fiz isso pois o link VIRTUA \u00e9 mais parrudo e por isso seu peso no balanceamento ser\u00e1 maior (analogia: 2 conex\u00f5es v\u00e3o para o virtua e 1 para a Embratel).<\/p>\n
2.4 Definido regras de roteamento<\/h4>\n
Definindo que pacotes vindos do IP do VIRTUAL usar\u00e3o a tabela VIRTUA<\/p>\n
ip rule add from VIRTUA_IPA table VIRTUA\r\n<\/code><\/pre>\n
Definindo que pacotes vindos do IP da EMBRATEL usar\u00e3o a tabela embratel<\/p>\n
ip rule add from EMBRATEL_IPA table EMBRATEL\r\n<\/code><\/pre>\n
Definindo que pacotes com a marca 2 usar\u00e3o a tabela de balanceamento<\/p>\n
ip rule add fwmark 2 table BALANCEAMENTO\r\n<\/code><\/pre>\n
Definindo que pacotes coma marca 1 usar\u00e3o a tabela Embratel<\/p>\n
ip rule add fwmark 1 table EMBRATEL\r\n<\/code><\/pre>\n
Essa \u00faltima regra estou criando pois existe um redirect para para rede interna, e portanto preciso tratar a ida e a volta para que n\u00e3o saia pelo balanceamento, e sim pela interface de origem do redirect que \u00e9 a EMBRATEL.<\/p>\n
2.5 Configurando rota padrao<\/h4>\n
Preciso configurar qual ser\u00e1 a rota padr\u00e3o<\/p>\n
ip route add default via EMBRATEL_GAT\r\n<\/code><\/pre>\n
\u00c9 poss\u00edvel fazer o balanceamento usando a tabela default, no final darei um exemplo disto.<\/p>\n
2.6 Limpando cache de tabelas<\/h4>\n
Necess\u00e1rio para fazer a limpeza de informa\u00e7\u00e3o que n\u00e3o \u00e9 \u00fatil, como por exemplo tabelas que foram deletadas.<\/p>\n
 ip route flush cache\r\n<\/code><\/pre>\n
3. Criando regras no netfilter\/iptables<\/h3>\n
3.1 Regras de redirecionamento<\/h4>\n
Primeiro redireciono para rede interna<\/p>\n
iptables -t nat -A PREROUTING -i eth2 -d 200.252.xx.xxx -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.1.0.xxx:80\r\n<\/code><\/pre>\n
Depois marco o pacote de retorno para ele usar a tabela embratel.<\/p>\n
iptables -t mangle -A PREROUTING -i eth0 -s 10.1.xx.xx -p tcp --sport 22 -j MARK --set-mark 1\r\n<\/code><\/pre>\n
3.2 Regras para balanceamento<\/h4>\n
Aqui eu marco os pacotes que desejo que usem a tabela de balanceamento.<\/p>\n
 iptables -t mangle -A PREROUTING -s 10.1.x.x\/24 -d 0\/0 -j MARK --set-mark 2\r\n<\/code><\/pre>\n
3.3 Mascarando pacotes<\/h4>\n
Aqui vamos mascarar os pacotes da rede interna, necess\u00e1rio para que as m\u00e1quinas consigam sair para internet e para o redirect.<\/p>\n
 iptables -t nat -A POSTROUTING -s 10.1.x.x\/24 -j MASQUERADE\r\n<\/code><\/pre>\n
3.4 Ativando ip forward<\/h4>\n
Precisamos ativar o encaminhamento de pacotes para que tudo funcione.<\/p>\n
echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward\r\n<\/code><\/pre>\n
Pronto, balanceamento feito, voc\u00ea pode usar o comando IPTRAF no servidor para avaliar se os dois links est\u00e3o sendo utilizados.<\/p>\n
Nas esta\u00e7\u00f5es recomendo que use o mtr-tiny para ver por onde seus pacotes est\u00e3o saindo.<\/p>\n
 mtr terra.com.br\r\n<\/code><\/pre>\n
Se preferir use o traceroute<\/p>\n
 traceroute uol.com.br\r\n<\/code><\/pre>\n
Automatizado<\/h2>\n
N\u00e3o d\u00e1 para executar todas as regras toda a vez que a m\u00e1quina inciar, seria cansativo e poder\u00edamos esquecer algo, logo criei um script para me ajudar com isto.<\/p>\n
4. Script de roteamento<\/h3>\n
\n
\n\n\n\n
\n
1<\/span>\r\n2<\/span>\r\n3<\/span>\r\n4<\/span>\r\n5<\/span>\r\n6<\/span>\r\n7<\/span>\r\n8<\/span>\r\n9<\/span>\r\n10<\/span>\r\n11<\/span>\r\n12<\/span>\r\n13<\/span>\r\n14<\/span>\r\n15<\/span>\r\n16<\/span>\r\n17<\/span>\r\n18<\/span>\r\n19<\/span>\r\n20<\/span>\r\n21<\/span>\r\n22<\/span>\r\n23<\/span>\r\n24<\/span>\r\n25<\/span>\r\n26<\/span>\r\n27<\/span>\r\n28<\/span>\r\n29<\/span>\r\n30<\/span>\r\n31<\/span>\r\n32<\/span>\r\n33<\/span>\r\n34<\/span>\r\n35<\/span>\r\n36<\/span>\r\n37<\/span>\r\n38<\/span>\r\n39<\/span>\r\n40<\/span>\r\n41<\/span>\r\n42<\/span>\r\n43<\/span>\r\n44<\/span>\r\n45<\/span>\r\n46<\/span>\r\n47<\/span>\r\n48<\/span>\r\n49<\/span>\r\n50<\/span>\r\n51<\/span>\r\n52<\/span>\r\n53<\/span>\r\n54<\/span>\r\n55<\/span>\r\n56<\/span>\r\n57<\/span>\r\n58<\/span>\r\n59<\/span>\r\n60<\/span>\r\n61<\/span>\r\n62<\/span>\r\n63<\/span>\r\n64<\/span>\r\n65<\/span>\r\n<\/pre>\n<\/td>\n
\n
#!\/bin\/bash<\/span>\r\n<\/span>\r\n# variaveis\/constantes<\/span>\r\n<\/span>\r\nVIRTUA_IPA<\/span>=<\/span>\"192.168.xxx.xxx\"<\/span>\r\n<\/span>VIRTUA_NET<\/span>=<\/span>\"192.168.xxx.xxx\/24\"<\/span>\r\n<\/span>VIRTUA_GAT<\/span>=<\/span>\"192.168.xxx.xxx\"<\/span>\r\n<\/span>VIRTUA_NIC<\/span>=<\/span>\"eth1\"<\/span>\r\n<\/span>\r\nEMBRATEL_IPA<\/span>=<\/span>\"200.252.xx.xxx\"<\/span>\r\n<\/span>EMBRATEL_NET<\/span>=<\/span>\"200.252.xx.xxx\/26\"<\/span>\r\n<\/span>EMBRATEL_GAT<\/span>=<\/span>\"200.252.xx.xxx\"<\/span>\r\n<\/span>EMBRATEL_NIC<\/span>=<\/span>\"eth2\"<\/span>\r\n<\/span>\r\n# limpando tabelas<\/span>\r\n<\/span>\r\nip route flush table VIRTUA\r\n<\/span>ip route flush table EMBRATEL\r\n<\/span>ip route flush table BALANCEAMENTO\r\n<\/span>\r\n# limpando regras<\/span>\r\n<\/span>\r\nip rule del from 200.252.xxx.xxx table EMBRATEL\r\n<\/span>ip rule del from 192.168.xxx.xxx table VIRTUA\r\n<\/span>ip rule del fwmark 0x2 table BALANCEAMENTO\r\n<\/span>ip rule del fwmark 0x1 table EMBRATEL\r\n<\/span>ip route del default\r\n<\/span>\r\n# configuracoes tabela VIRTUA<\/span>\r\n<\/span>\r\nip route add $VIRTUA_NET<\/span> dev $VIRTUA_NIC<\/span> src $VIRTUA_IPA<\/span> table VIRTUA\r\n<\/span>ip route add default via $VIRTUA_GAT<\/span> table VIRTUA\r\n<\/span>\r\n# configuracoes tabela EMBRATEL<\/span>\r\n<\/span>\r\nip route add $EMBRATEL_NET<\/span> dev $EMBRATEL_NIC<\/span> src $EMBRATEL_IPA<\/span> table EMBRATEL\r\n<\/span>ip route add default via $EMBRATEL_GAT<\/span> table EMBRATEL\r\n<\/span>\r\n# trafico da eth1 sai pela tabela VIRTUA<\/span>\r\n<\/span>\r\nip rule add from $VIRTUA_IPA<\/span> table VIRTUA\r\n<\/span>\r\n# trafico da eth2 sai pela tabela EMBRATEL<\/span>\r\n<\/span>\r\nip rule add from $EMBRATEL_IPA<\/span> table EMBRATEL\r\n<\/span>\r\n# definindo regra para marcacao de pacotes da intranet sairem pelo BALANCEAMENTO<\/span>\r\n<\/span>\r\nip rule add fwmark 2 table BALANCEAMENTO\r\n<\/span>\r\n# definindo regra para pacotes marcados sairem pela EMBRATEL<\/span>\r\n<\/span>\r\nip rule add fwmark 1 table EMBRATEL\r\n<\/span>\r\n# Criando balanceamento multilink para tabela BALANCEAMENTO<\/span>\r\n<\/span>\r\nip route add default scope global table BALANCAMENTO nexthop via $VIRTUA_GAT<\/span> dev $VIRTUA_NIC<\/span> weight 1 nexthop via $EMBRATEL_GAT<\/span> dev $EMBRATEL_NIC<\/span> weight 1\r\n<\/span>\r\n# definindo rota padrao<\/span>\r\n<\/span>\r\nip route add default via $EMBRATEL_GAT<\/span>\r\n<\/span>\r\n# fazendo flush no cache de rotas que foram deletadas<\/span>\r\n<\/span>\r\nip route flush cache\r\n<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/figure>\n
5. Script de firewall<\/h3>\n
\n
\n\n\n\n
\n
1<\/span>\r\n2<\/span>\r\n3<\/span>\r\n4<\/span>\r\n5<\/span>\r\n6<\/span>\r\n7<\/span>\r\n8<\/span>\r\n9<\/span>\r\n10<\/span>\r\n11<\/span>\r\n12<\/span>\r\n13<\/span>\r\n14<\/span>\r\n15<\/span>\r\n16<\/span>\r\n17<\/span>\r\n18<\/span>\r\n19<\/span>\r\n20<\/span>\r\n21<\/span>\r\n22<\/span>\r\n23<\/span>\r\n24<\/span>\r\n25<\/span>\r\n26<\/span>\r\n27<\/span>\r\n28<\/span>\r\n29<\/span>\r\n30<\/span>\r\n31<\/span>\r\n32<\/span>\r\n33<\/span>\r\n34<\/span>\r\n35<\/span>\r\n36<\/span>\r\n37<\/span>\r\n38<\/span>\r\n39<\/span>\r\n40<\/span>\r\n41<\/span>\r\n42<\/span>\r\n43<\/span>\r\n44<\/span>\r\n45<\/span>\r\n46<\/span>\r\n47<\/span>\r\n48<\/span>\r\n49<\/span>\r\n50<\/span>\r\n51<\/span>\r\n52<\/span>\r\n53<\/span>\r\n<\/pre>\n<\/td>\n
\n
#!\/bin\/bash<\/span>\r\n<\/span>\r\n# variaveis\/constantes<\/span>\r\n<\/span>\r\nIPTABLES<\/span>=<\/span>\"\/sbin\/iptables\"<\/span>\r\n<\/span>\r\n### limpando tabela filter<\/span>\r\n<\/span>\r\n$IPTABLES<\/span> -t filter -F\r\n<\/span>$IPTABLES<\/span> -t filter -P INPUT ACCEPT\r\n<\/span>$IPTABLES<\/span> -t filter -P OUTPUT ACCEPT\r\n<\/span>$IPTABLES<\/span> -t filter -P FORWARD ACCEPT\r\n<\/span>$IPTABLES<\/span> -t filter -X\r\n<\/span>\r\n### limpando tabela nat<\/span>\r\n<\/span>\r\n$IPTABLES<\/span> -t nat -F\r\n<\/span>$IPTABLES<\/span> -t nat -P PREROUTING ACCEPT\r\n<\/span>$IPTABLES<\/span> -t nat -P OUTPUT ACCEPT\r\n<\/span>$IPTABLES<\/span> -t nat -P POSTROUTING ACCEPT\r\n<\/span>$IPTABLES<\/span> -t nat -X\r\n<\/span>\r\n### limpando tabela mangle<\/span>\r\n<\/span>\r\n$IPTABLES<\/span> -t mangle -F\r\n<\/span>$IPTABLES<\/span> -t mangle -P PREROUTING ACCEPT\r\n<\/span>$IPTABLES<\/span> -t mangle -P INPUT ACCEPT\r\n<\/span>$IPTABLES<\/span> -t mangle -P FORWARD ACCEPT\r\n<\/span>$IPTABLES<\/span> -t mangle -P OUTPUT ACCEPT\r\n<\/span>$IPTABLES<\/span> -t mangle -P POSTROUTING ACCEPT\r\n<\/span>$IPTABLES<\/span> -t mangle -X\r\n<\/span>\r\n### ativando ip forward<\/span>\r\n<\/span>\r\necho <\/span>1 > \/proc\/sys\/net\/ipv4\/ip_forward\r\n<\/span>\r\n### Fazendo redirecionamento para servidores na rede interna<\/span>\r\n<\/span>\r\n# tratando a ida<\/span>\r\n<\/span>$IPTABLES<\/span> -t nat -A PREROUTING -i eth2 -d 200.252.xxx.xxx -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.1.0.20:80\r\n<\/span>\r\n# tratando a volta<\/span>\r\n<\/span>$IPTABLES<\/span> -t mangle -A PREROUTING -i eth0 -s 10.1.0.20 -p tcp --sport 80 -j MARK --set-mark 1\r\n<\/span>\r\n### Marcando pacotes que serao direcionados para tabela BALANCEAMENTO<\/span>\r\n<\/span>\r\n# especificando uma maquina da rede para usar balanceamento<\/span>\r\n<\/span>$IPTABLES<\/span> -A PREROUTING -t mangle -s 10.1.0.100\/32 -d 0\/0 -j MARK --set-mark 2\r\n<\/span>\r\n# Mascarando conexoes<\/span>\r\n<\/span>\r\n$IPTABLES<\/span> -t nat -A POSTROUTING -s 10.1.0.20\/24 -j MASQUERADE\r\n<\/span>$IPTABLES<\/span> -t nat -A POSTROUTING -s 10.1.0.100\/24 -j MASQUERADE\r\n<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/figure>\n
6. Colocando scripts para rodar durante a inicializa\u00e7\u00e3o<\/h3>\n
Voc\u00ea pode simplesmente chamar os scripts no arquivo \/etc\/rc.local, vamos supor que os scripts estejam dentro de \/root\/rules e tenham o nome de rc.routes e rc.firewall.<\/p>\n
Edite o arquivo<\/p>\n
vim \/etc\/rc.local\r\n<\/code><\/pre>\n
Adicione<\/p>\n
\/root\/rules\/rc.routes\r\n\/root\/rules\/rc.firewall\r\n<\/code><\/pre>\n
Salve<\/p>\n
:wq!\r\n<\/code><\/pre>\n
Pronto, desde que eles tenham permiss\u00e3o de execu\u00e7\u00e3o tudo est\u00e1 pronto para funcionar, se quiser testar para valer d\u00ea um reboot.<\/p>\n
Outras dicas<\/h2>\n
7. Usando Proxy Transparente na mesma m\u00e1quina<\/h3>\n
Se quiser configurar um proxy transparente a regra abaixo resolve.<\/p>\n
$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp -s $LAN_NET --dport 80 -j REDIRECT --to-port 3128\r\n<\/code><\/pre>\n
Voc\u00ea precisa ter o SQUID na mesma m\u00e1quina.<\/p>\n
8. Sa\u00edda por link espec\u00edfico para destino espec\u00edfico<\/h3>\n
Se quiser acessar um site sempre por uma das sa\u00eddas, por exemplo embratel, basta marcar assim:<\/p>\n
 $IPTABLES -A PREROUTING -t mangle -s 10.1.xxx.xxx\/xx -d 186.202.xxx.xxx -j MARK --set-mark 1\r\n<\/code><\/pre>\n
Como estou marcando com 2, ele sairia para embratel toda a vez que o destino fosse 186.202.xxx.xxx<\/p>\n
8.1 Servi\u00e7o espec\u00edfico saindo por link espec\u00edfico<\/h4>\n
Podemos especificar que toda o envio de e-mail (SMTP) ser\u00e1 feito pelo link EMBRATEL que \u00e9 mais est\u00e1vel, seguro e tem menos chances se estar em um lista de bloqueio.<\/p>\n
$IPTABLES -A PREROUTING -t mangle -s 10.1.xxx.xxx\/xx -d 0\/0 --dport 25 -j MARK --set-mark 1\r\n<\/code><\/pre>\n
9. SQUID usando Balanceamento<\/h3>\n
Se tiver um squid na mesma m\u00e1quina e desejar que ele use a tabela de balanceamento ao inv\u00e9s da rota padr\u00e3o, defina a configura\u00e7\u00e3o abaixo no squid.conf<\/p>\n
tcp_outgoing_tos 0x2 redelocal\r\n<\/code><\/pre>\n
0x1 \u00e9 referente a marca\u00e7\u00e3o no iptables para sa\u00edda pela tabela de balanceamento e rede local seria relativa a uma ACL que tem como conte\u00fado o endere\u00e7o da rede local.<\/p>\n
7.1 Exemplo de squid.conf<\/h4>\n
Aqui um exemplo de conf de squid3 que s\u00f3 faz cache na porta 80.<\/p>\n
\n
\n\n\n\n
\n
1<\/span>\r\n2<\/span>\r\n3<\/span>\r\n4<\/span>\r\n5<\/span>\r\n6<\/span>\r\n7<\/span>\r\n8<\/span>\r\n9<\/span>\r\n10<\/span>\r\n11<\/span>\r\n12<\/span>\r\n13<\/span>\r\n14<\/span>\r\n15<\/span>\r\n16<\/span>\r\n17<\/span>\r\n18<\/span>\r\n19<\/span>\r\n20<\/span>\r\n21<\/span>\r\n22<\/span>\r\n23<\/span>\r\n24<\/span>\r\n25<\/span>\r\n26<\/span>\r\n27<\/span>\r\n28<\/span>\r\n29<\/span>\r\n30<\/span>\r\n31<\/span>\r\n32<\/span>\r\n33<\/span>\r\n34<\/span>\r\n35<\/span>\r\n36<\/span>\r\n37<\/span>\r\n38<\/span>\r\n39<\/span>\r\n40<\/span>\r\n41<\/span>\r\n42<\/span>\r\n43<\/span>\r\n44<\/span>\r\n45<\/span>\r\n46<\/span>\r\n47<\/span>\r\n48<\/span>\r\n49<\/span>\r\n50<\/span>\r\n51<\/span>\r\n52<\/span>\r\n53<\/span>\r\n54<\/span>\r\n55<\/span>\r\n56<\/span>\r\n57<\/span>\r\n58<\/span>\r\n59<\/span>\r\n60<\/span>\r\n61<\/span>\r\n62<\/span>\r\n63<\/span>\r\n64<\/span>\r\n65<\/span>\r\n66<\/span>\r\n67<\/span>\r\n68<\/span>\r\n69<\/span>\r\n70<\/span>\r\n71<\/span>\r\n72<\/span>\r\n73<\/span>\r\n74<\/span>\r\n75<\/span>\r\n76<\/span>\r\n77<\/span>\r\n78<\/span>\r\n79<\/span>\r\n80<\/span>\r\n81<\/span>\r\n82<\/span>\r\n83<\/span>\r\n84<\/span>\r\n85<\/span>\r\n86<\/span>\r\n87<\/span>\r\n88<\/span>\r\n89<\/span>\r\n90<\/span>\r\n91<\/span>\r\n92<\/span>\r\n93<\/span>\r\n94<\/span>\r\n95<\/span>\r\n96<\/span>\r\n97<\/span>\r\n98<\/span>\r\n99<\/span>\r\n100<\/span>\r\n101<\/span>\r\n102<\/span>\r\n103<\/span>\r\n104<\/span>\r\n105<\/span>\r\n106<\/span>\r\n107<\/span>\r\n108<\/span>\r\n109<\/span>\r\n110<\/span>\r\n111<\/span>\r\n112<\/span>\r\n113<\/span>\r\n114<\/span>\r\n115<\/span>\r\n116<\/span>\r\n117<\/span>\r\n118<\/span>\r\n119<\/span>\r\n120<\/span>\r\n121<\/span>\r\n122<\/span>\r\n123<\/span>\r\n124<\/span>\r\n125<\/span>\r\n126<\/span>\r\n127<\/span>\r\n128<\/span>\r\n129<\/span>\r\n130<\/span>\r\n131<\/span>\r\n132<\/span>\r\n133<\/span>\r\n134<\/span>\r\n135<\/span>\r\n136<\/span>\r\n137<\/span>\r\n138<\/span>\r\n139<\/span>\r\n140<\/span>\r\n141<\/span>\r\n142<\/span>\r\n143<\/span>\r\n144<\/span>\r\n145<\/span>\r\n146<\/span>\r\n147<\/span>\r\n148<\/span>\r\n149<\/span>\r\n150<\/span>\r\n151<\/span>\r\n152<\/span>\r\n153<\/span>\r\n154<\/span>\r\n155<\/span>\r\n156<\/span>\r\n157<\/span>\r\n158<\/span>\r\n159<\/span>\r\n160<\/span>\r\n161<\/span>\r\n162<\/span>\r\n163<\/span>\r\n164<\/span>\r\n165<\/span>\r\n166<\/span>\r\n167<\/span>\r\n168<\/span>\r\n169<\/span>\r\n170<\/span>\r\n171<\/span>\r\n172<\/span>\r\n173<\/span>\r\n174<\/span>\r\n175<\/span>\r\n176<\/span>\r\n177<\/span>\r\n178<\/span>\r\n179<\/span>\r\n180<\/span>\r\n181<\/span>\r\n182<\/span>\r\n<\/pre>\n<\/td>\n
\n
#### porta #################################\r\n<\/span> \r\nhttp_port 3128\r\n<\/span> \r\n### hostname ###################\r\n<\/span> \r\nvisible_hostname fw01\r\n<\/span> \r\n### dns servers #################\r\n<\/span> \r\ndns_nameservers xxx.xxx.xxx.xxx\r\n<\/span> \r\n### configuracoes de cache ############\r\n<\/span># referencia: http:\/\/www.visolve.com\/squid\/squid24s1\/cache_size.php\r\n<\/span># referencia: http:\/\/www.visolve.com\/squid\/squid24s1\/cache_size.php#cache_replacement_policy\r\n<\/span> \r\n# setando para 2 gigas, os outros 2 gigas vamos deixar 1 giga para sistema e\r\n<\/span># 1 giga para opera\u00e7\u00e3o do cache em disco\r\n<\/span> \r\ncache_mem 2048 MB\r\n<\/span> \r\n# tamanho de objetos em memoria e disco\r\n<\/span> \r\nmaximum_object_size_in_memory 512 KB\r\n<\/span>maximum_object_size 64 MB\r\n<\/span>minimum_object_size 0 KB\r\n<\/span> \r\n# quais o rate para objetos devem serem swapados\r\n<\/span>cache_swap_low 90\r\n<\/span>cache_swap_high 95\r\n<\/span> \r\n# heap GDSF: otimiza o \"hit rate\" por manter objetos pequenos e\r\n<\/span># e populares no cache, guardando assim um numero maior de objetos\r\n<\/span># ao inves de buscar no disco ja esta na memoria, maior velocidade\r\n<\/span># na resposta ao usuario\r\n<\/span> \r\nmemory_replacement_policy heap GDSF\r\n<\/span> \r\n# heap LFUDA: otimiza o \"byte hit rate\" por manter objetos populares\r\n<\/span># no cache sem levar em conta o tamanho. Se for utilizado este, o\r\n<\/span># maximum_object_size devera ser aumentado para otimizar o LFUDA.\r\n<\/span> \r\ncache_replacement_policy heap LFUDA\r\n<\/span> \r\n# Lembrando que cada 10GB de cache o squid consome 100MB de ram para gerenciar isto\r\n<\/span># colocando 100GB de STORAGE o squid vai usar 1 Giga da RAM para gerenciar o cache do disco\r\n<\/span># estou reservando entao 3 gigas para o squid, 2 para cache_mem e 1 para cuidar do cache em disco, sobrando 1 GB para o sistema usar.\r\n<\/span># Em relacao ao metodo de gerenciamento do cache, aufs \u00e9 + rapido que ufs\r\n<\/span> \r\ncache_dir aufs \/var\/spool\/squid3 4096 16 256\r\n<\/span> \r\n# user\/group\/manager\r\n<\/span> \r\ncache_mgr infraestrutura@empresa.com.br\r\n<\/span>cache_effective_user proxy\r\n<\/span>cache_effective_group proxy\r\n<\/span> \r\n### ttl de objetos no cache ###########################\r\n<\/span># http:\/\/www.squid-cache.org\/Doc\/config\/refresh_pattern\/\r\n<\/span> \r\nrefresh_pattern ^ftp:                1440        20%        10080\r\n<\/span>refresh_pattern ^gopher:        1440        0%        1440\r\n<\/span>refresh_pattern -i (\/cgi-bin\/|\\?) 0        0%        0\r\n<\/span>refresh_pattern (Release|Package(.gz)*)$        0        20%        2880\r\n<\/span>refresh_pattern .                0        20%        4320\r\n<\/span> \r\n \r\n###\r\n<\/span>### listas de controle #######################\r\n<\/span>###\r\n<\/span> \r\nhierarchy_stoplist cgi-bin ?\r\n<\/span> \r\n# acl ligada a autenticacao\r\n<\/span> \r\n# acesso padrao daemon squid\r\n<\/span>acl all src all\r\n<\/span>acl manager proto cache_object\r\n<\/span>acl localhost src 127.0.0.1\/32\r\n<\/span>acl to_localhost dst 127.0.0.0\/8\r\n<\/span> \r\n# redes para icp (proxy filho)\r\n<\/span>acl localnet src 10.1.xxx.xxx\/24\r\n<\/span> \r\n# portas seguras\r\n<\/span>acl SSL_ports port 443                # https\r\n<\/span>acl SSL_ports port 465                # https\r\n<\/span>acl SSL_ports port 587                # https\r\n<\/span>acl SSL_ports port 993                # https\r\n<\/span>acl SSL_ports port 997                # https\r\n<\/span> \r\n# portas comuns\r\n<\/span>acl Safe_ports port 80                 # http\r\n<\/span>acl Safe_ports port 8080               # http\r\n<\/span>acl Safe_ports port 21                 # ftp\r\n<\/span>acl Safe_ports port 25                 # smtp\r\n<\/span>acl Safe_ports port 110                # pop\r\n<\/span> \r\n# acl que especifica metodos de conectividade\r\n<\/span>acl purge method PURGE\r\n<\/span>acl CONNECT method CONNECT\r\n<\/span> \r\n# acl que especifica tipo de consulta QUERY em cgi-bin\r\n<\/span>acl QUERY urlpath_regex cgi-bin \\?\r\n<\/span> \r\n###\r\n<\/span>### controle de acesso #############################################\r\n<\/span>###\r\n<\/span> \r\n# liberacoes padrao daemon\/localhost\r\n<\/span>http_access allow manager localhost\r\n<\/span>http_access deny manager\r\n<\/span>http_access allow purge localhost\r\n<\/span>http_access deny purge\r\n<\/span> \r\n# nao libera portas diferentes de Safe_ports e SSL_ports\r\n<\/span>http_access deny !Safe_ports\r\n<\/span>http_access deny CONNECT !SSL_ports\r\n<\/span> \r\n# nao cacheia cgi-bin\r\n<\/span>cache deny QUERY\r\n<\/span> \r\n# libera rede local\r\n<\/span>http_access allow localnet\r\n<\/span>\r\n# bloqueia qualquer acesso que nao tenha casado com as regras acima\r\n<\/span>http_access deny all\r\n<\/span>\r\n### especificando uso da tabela BALANCEAMENTO (roteamento) \r\n<\/span>\r\ntcp_outgoing_tos 0x1 localnet\r\n<\/span> \r\n###\r\n<\/span>### processando em paralelo ###########\r\n<\/span>###\r\n<\/span> \r\n# http:\/\/www.visolve.com\/squid\/squid24s1\/delaypool.php\r\n<\/span> \r\npipeline_prefetch on\r\n<\/span> \r\n### reiniciando rapidamente #######\r\n<\/span> \r\nshutdown_lifetime 1 second\r\n<\/span> \r\n### estatisticas de conexao #######\r\n<\/span> \r\n# If enabled, squid will keep statistics on each client.\r\n<\/span># This can become a memory hog after a while, so it\u2019s best to keep it disabled.\r\n<\/span> \r\nclient_db off\r\n<\/span> \r\n### conexoes #################\r\n<\/span> \r\n# Sends a connection-close to clients\r\n<\/span># that leave a half open connection to the squid server.\r\n<\/span> \r\nhalf_closed_clients off\r\n<\/span> \r\n### snmp ####################\r\n<\/span> \r\nacl snmpcommunity snmp_community empresa\r\n<\/span>snmp_port 3401\r\n<\/span>snmp_access allow snmpcommunity localhost\r\n<\/span>snmp_access deny all\r\n<\/span> \r\n### logs #################\r\n<\/span> \r\naccess_log \/var\/log\/squid3\/access.log squid\r\n<\/span>cache_log \/var\/log\/squid3\/cache.log\r\n<\/span> \r\n# Log de objetos guardados. Pode ser desativado para melhorar a performance\r\n<\/span>\r\ncache_store_log none\r\n<\/span> \r\n### idioma das mensagens do squid para usuarios ################\r\n<\/span> \r\nerror_directory \/usr\/share\/squid3\/errors\/Portuguese\r\n<\/span> \r\n### arquivos ###################\r\n<\/span> \r\nhosts_file \/etc\/hosts\r\n<\/span>coredump_dir \/var\/spool\/squid3\r\n<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/figure>\n
7.2 Exemplo de balanceamento usando tabela default<\/h3>\n
Ao inv\u00e9s de criar uma tabela espec\u00edfica para balanceamento, podemos definir o balanceamento na tabela default.<\/p>\n
ip route add default scope global nexthop via 189.xxx.xxx.xxx \\\r\ndev eth1 weight 1 nexthop via 200.xxx.xxx.xxx dev eth2 weight 1\r\n<\/code><\/pre>\n
\u00c9 apenas uma outra forma de faz\u00ea-lo, mais direta.<\/p>\n
Amarrando as pontas<\/h2>\n
8. Conclus\u00e3o<\/h3>\n
O Netfilter\/iptables e Iproute2 possuem juntos um universo de funcionalidades e comandos para te ajudar a resolver os mais diversos problemas.<\/p>\n
O exemplo deste post \u00e9 bem b\u00e1sico e simples, espero que sirva de refer\u00eancia para aqueles que necessitem balancear dois ou mais links.<\/p>\n
8.2 Cuidado com testes MEUIP<\/h3>\n
Se estiver tentando ver se o balanceamento funciona usando sites MEUIP, voc\u00ea est\u00e1 fazendo errado. O balanceamento possui um cache, e no caso do mesmo site ele vai analisar por qual link voce acessou aquele site e vai sair sempre por ele, isso ocorre para evitar problemas ao acessar sites que precisam de persist\u00eancia de sess\u00e3o.<\/p>\n
O balanceamento vai funcionar, mas acesse sites diferentes para testar e use o MTR no console para avaliar por onde voc\u00ea est\u00e1 saindo, isso ser\u00e1 mais eficiente.<\/p>\n
9. Refer\u00eancias de pesquisa<\/h3>\n
9.1 Principais<\/h3>\n
    \n
  • https:\/\/www.policyrouting.org\/iproute2.doc.html<\/li>\n
  • https:\/\/netfilter.org\/documentation\/<\/li>\n<\/ul>\n
    9.2 Secund\u00e1rios<\/h3>\n
      \n
    • https:\/\/lartc.org\/howto\/lartc.rpdb.multiple-links.html<\/li>\n
    • https:\/\/www.debian-administration.org\/articles\/377<\/li>\n
    • https:\/\/www.enterprisenetworkingplanet.com\/netos\/article.php\/3512836\/Tunnels-Routes-and-Rules-Theyre-Easier-with-iproute2.htm<\/li>\n
    • https:\/\/blog.nielshorn.net\/2008\/09\/load-balancing-two-isps\/<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
      Em um projeto recente precisei fazer o balanceamento de links no linux, o cliente possu\u00eda sa\u00edda por dois provedores, sendo o primeiro NET\/Virtua e o segundo Embratel, seu link Embratel estava ocioso e ele queria acabar com essa ociosidade. A solu\u00e7\u00e3o foi usar o iproute2 para criar uma tabela com balanceamento de links para alguns […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1082,1,730,830,79,1062,42,51,495,1162,68,548],"tags":[1401,353,83,10,14,361],"class_list":["post-4753","post","type-post","status-publish","format-standard","hentry","category-centos-7-rhel-7","category-viazap","category-clusterweb","category-debian","category-firewall","category-freenas","category-leitura-recomendada","category-linux-linuxrs","category-profissional-de-ti","category-proxmox","category-redes-2","category-ubuntu-2","tag-balanceando","tag-de","tag-internet","tag-links","tag-linux","tag-no"],"_links":{"self":[{"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/4753","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4753"}],"version-history":[{"count":1,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/4753\/revisions"}],"predecessor-version":[{"id":4754,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/4753\/revisions\/4754"}],"wp:attachment":[{"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4753"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4753"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.clusterweb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4753"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}