IPVSADM(8) Linux Administrator's Guide IPVSADM(8) (NAME) ipvsadm - (IPVS) (SYNOPSIS) ipvsadm -A|E virtual-service [-s scheduler] [-p [timeout]] [-M netmask] [-b sched-flags] ipvsadm -D virtual-service ipvsadm -C ipvsadm -R ipvsadm -S [-n] ipvsadm -a|e virtual-service -r server-address [-g|i|m] [-w weight] [-x upper] [-y lower] ipvsadm -d virtual-service -r server-address ipvsadm -L|l [virtual-service] [options] ipvsadm -Z [virtual-service] ipvsadm --set tcp tcpfin udp ipvsadm --start-daemon state [daemon-options] [--syncid syncid] ipvsadm --stop-daemon state ipvsadm -h (DESCRIPTION) Ipvsadm(8) . (LVS) . . (TCP UDP SCTP) (NAT ) ( ) . : ipvsadm COMMAND virtual-service [scheduling-method] [persistence options] ipvsadm command virtual-service server-address [packet-forwarding-method] [weight options] . . . . (COMMANDS) ipvsadm(8) . . . -A, --add-service . : IP . (firewall- mark) . -E, --edit-service . -D, --delete-service . -C, --clear . -R, --restore (stdin). ipvsadm . "ipvsadm" . ipvsadm . -S, --save (stdout) -R|--restore . -a, --add-server . -e, --edit-server . -d, --delete-server . -L, -l, --list . service-address . -c . . -Z, --zero . --set tcp tcpfin udp (timeout) IPVS. ( ) TCP TCP FIN UDP . 0 . --start-daemon state . state master () backup () . . (multicast) . . IPv4 IPv6 . --stop-daemon . -h, --help . (virtual-service) // . -t, --tcp-service service-address TCP. service-address host[:port] . Host IP . Port . Port . Port -p|--persistent (wild-card) . -u, --udp-service service-address UDP. service-address -t|--tcp-service . --sctp-service service-address SCTP. service-address -t|--tcp-service . -f, --fwmark-service integer (firewall-mark) (UDP TCP SCTP) . -m|--mark iptables(8) meta mark set value nft(8) eBPF . IP . IPv6 -6 . IP . . (PARAMETERS) . -s, --scheduler scheduling-method scheduling-method TCP UDP . . : rr - (Round Robin): . wrr - (Weighted Round Robin): . . . lc - (Least-Connection): . wlc - (Weighted Least-Connection): (Ci/Wi) . . lblc - (Locality-Based Least-Connection): IP . lblcr - (Locality-Based Least-Connection with Replication): IP IP . . . dh - (Destination Hashing): IP . sh - (Source Hashing): IP . : sh-fallback sh-port . sed - (Shortest Expected Delay): . i- (Ci + 1) / Ui Ci i- Ui () i- . nq - (Never Queue): . fo - (Weighted Failover): . ovf - (Weighted Overflow): . UDP . mh - (Maglev Hashing): Maglev . . : mh-fallback mh-port . -p, --persistent [timeout] (persistent) . . timeout ( ) . SSL FTP . : FTP (Direct Routing) (Tunnelling) . Masquerading FTP ip_vs_ftp . insmod(8) . -M, --netmask netmask . . 255.255.255.255 . . IPv6 . . --pe persistence-engine . sip . -b, --sched-flags sched-flags . sched- flags . . -r, --real-server server-address . server- address host port . Host IP . Port . masquerading IP RFC 1918 . port . port . fwmark port . [packet-forwarding-method] -g, --gatewaying gatewaying ( ). . -i, --ipip ipip (). --tun-type tun-type tun-type ipip|gue|gre . tun-type ipip . --tun-port tun-port tun-port . tun-type gue . --tun-nocsum (checksums) . . tun-type gue gre . --tun-csum . tun-type gue gre . --tun-remcsum (Remote Checksum Offload) . tun-type gue . -m, --masquerading masquerading ( NAT). : . ipvsadm . -w, --weight weight Weight . weight 0 65535 . 1 . (quiescent) . . . -x, --u-threshold uthreshold uthreshold . uthreshold 0 65535 . 0 . uthreshold . -y, --l-threshold lthreshold lthreshold . lthreshold 0 65535 . 0 . lthreshold . lthreshold uthreshold . -c, --connection . list IPVS . --timeout . list ( ) TCP TCP FIN UDP . --daemon . list . --stats . list . --rate . list ( ) . --thresholds . list / . --persistent-conn . list . / . list -c, --connection ( ) . --tun-info . list . --sort . < > . < > (). --nosort . -n, --numeric . IP . --exact . K ( ) M ( K) G ( M). -L . -6, --ipv6 -f fwmark IPv6 . -o, --ops (One- packet scheduling). UDP fwmark UDP . . (PARAMETERS FOR SYNCHRONIZATION DAEMON) --start-daemon . --syncid syncid syncid SyncID SyncID . syncid 0 255 . 0 . --sync-maxlen length ( UDP) . . length 1 .. (65535 - 20 - 8) . MTU IP (fragment) . MTU 1500 . --mcast-interface interface . --mcast-group address IPv4 IPv6 . 224.0.0.81 . --mcast-port port UDP . 8848 . --mcast-ttl ttl TTL (1 .. 255). 1 . - (EXAMPLE 1 - Simple Virtual Service) (Linux Director) 80 207.175.44.110 80 . NAT (masqueraded) . ipvsadm -A -t 207.175.44.110:80 -s rr ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.1:80 -m ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.2:80 -m ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.3:80 -m ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.4:80 -m ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.5:80 -m ipvsadm : echo " -A -t 207.175.44.110:80 -s rr -a -t 207.175.44.110:80 -r 192.168.10.1:80 -m -a -t 207.175.44.110:80 -r 192.168.10.2:80 -m -a -t 207.175.44.110:80 -r 192.168.10.3:80 -m -a -t 207.175.44.110:80 -r 192.168.10.4:80 -m -a -t 207.175.44.110:80 -r 192.168.10.5:80 -m " | ipvsadm -R masquerading . : echo "1" > /proc/sys/net/ipv4/ip_forward - (EXAMPLE 2 - Firewall-Mark Virtual Service) 207.175.44.110 207.175.44.111 . NAT (masqueraded) . ipvsadm -A -f 1 -s rr ipvsadm -a -f 1 -r 192.168.10.1:0 -m ipvsadm -a -f 1 -r 192.168.10.2:0 -m ipvsadm -a -f 1 -r 192.168.10.3:0 -m ipvsadm -a -f 1 -r 192.168.10.4:0 -m ipvsadm -a -f 1 -r 192.168.10.5:0 -m masquerading . 207.175.44.110 207.175.44.111 1 . FTP ip_vs_ftp . : echo "1" > /proc/sys/net/ipv4/ip_forward modprobe ip_tables iptables -A PREROUTING -t mangle -d 207.175.44.110/31 -j MARK --set-mark 1 modprobe ip_vs_ftp - GUE (EXAMPLE 3 - Virtual Service with GUE Tunneling) 80 207.175.44.110 80 . gue . ipvsadm -A -t 207.175.44.110:80 -s rr ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.1:80 -i --tun-type gue --tun-port 6080 --tun-nocsum ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.2:80 -i --tun-type gue --tun-port 6080 --tun-csum ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.3:80 -i --tun-type gue --tun-port 6080 --tun-remcsum ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.4:80 -i --tun-type gue --tun-port 6078 ipvsadm -a -t 207.175.44.110:80 -r 192.168.10.5:80 -i --tun-type gue --tun-port 6079 ipvsadm : echo " -A -t 207.175.44.110:80 -s rr -a -t 207.175.44.110:80 -r 192.168.10.1:80 -i --tun-type gue --tun-port 6080 --tun-nocsum -a -t 207.175.44.110:80 -r 192.168.10.2:80 -i --tun-type gue --tun-port 6080 --tun-csum -a -t 207.175.44.110:80 -r 192.168.10.3:80 -i --tun-type gue --tun-port 6080 --tun-remcsum -a -t 207.175.44.110:80 -r 192.168.10.4:80 -i --tun-type gue --tun-port 6078 -a -t 207.175.44.110:80 -r 192.168.10.5:80 -i --tun-type gue --tun-port 6079 " | ipvsadm -R - GRE (EXAMPLE 4 - Virtual Service with GRE Tunneling) GRE . ipvsadm -A -t 10.0.0.1:80 -s rr ipvsadm -a -t 10.0.0.1:80 -r 192.168.11.1:80 -i --tun-type gre --tun-csum IPv6 IPv6 ([ ]) . ipvsadm -A -t [2001:db8::80]:80 -s rr ipvsadm -a -t [2001:db8::80]:80 -r [2001:db8::a0a0]:80 -m fwmark IPv6 -6 . (NOTES) (DoS) . . LVS DoS . : 1/rate TCP . sysctl /proc : /proc/sys/net/ipv4/vs/drop_entry /proc/sys/net/ipv4/vs/drop_packet /proc/sys/net/ipv4/vs/secure_tcp 0 3 . 0 . 1 2 - 2 1 . 3 . TCP sysctl /proc : /proc/sys/net/ipv4/vs/amemthresh /proc/sys/net/ipv4/vs/timeout_* (FILES) /proc/net/ip_vs /proc/net/ip_vs_app /proc/net/ip_vs_conn /proc/net/ip_vs_stats /proc/sys/net/ipv4/vs/am_droprate /proc/sys/net/ipv4/vs/amemthresh /proc/sys/net/ipv4/vs/drop_entry /proc/sys/net/ipv4/vs/drop_packet /proc/sys/net/ipv4/vs/secure_tcp /proc/sys/net/ipv4/vs/timeout_close /proc/sys/net/ipv4/vs/timeout_closewait /proc/sys/net/ipv4/vs/timeout_established /proc/sys/net/ipv4/vs/timeout_finwait /proc/sys/net/ipv4/vs/timeout_icmp /proc/sys/net/ipv4/vs/timeout_lastack /proc/sys/net/ipv4/vs/timeout_listen /proc/sys/net/ipv4/vs/timeout_synack /proc/sys/net/ipv4/vs/timeout_synrecv /proc/sys/net/ipv4/vs/timeout_synsent /proc/sys/net/ipv4/vs/timeout_timewait /proc/sys/net/ipv4/vs/timeout_udp (SEE ALSO) LVS (http://www.linuxvirtualserver.org) LVS. ipvsadm-save(8), ipvsadm-restore(8), iptables(8), insmod(8), modprobe(8) (AUTHORS) ipvsadm - Wensong Zhang Peter Kese man page - Mike Wangsmo Wensong Zhang Horms 4th Berkeley Distribution 5th July 2003 IPVSADM(8)