阿里云SLB不能负载到ECS的解决

新加的机器ECS,通过SLB居然负载不上去,网上百度了很多方法,甚至还求助了阿里云内部工作人员,无果.最后想到之前申请的机器都会执行一个脚本,修改一些配置.之后搜索了一些相关文章,发现了其中的问题.

对于添加到负载均衡实例后端的ECS，原则上不需要进行特别的配置。如果针对关联到负载均衡4层（TCP协议）服务的Linux系统的ECS，如果发现无法正常访问，需要确保系统配置文件/etc/sysctl.conf的以下三项为0

1
net.ipv4.conf.default.rp_filter = 0
2
net.ipv4.conf.all.rp_filter = 0
3
net.ipv4.conf.eth0.rp_filter = 0

如果部署在同一内网网段下的ECS之间有通信需求，且发现有无法通信的情况存在，那么需要检查如下参数的配置是否正确

1
net.ipv4.conf.default.arp_announce =2
2
net.ipv4.conf.all.arp_announce =2

• 更新配置

1
sysctl -p

• 脚本分享

  1
  #######main
  2
  
  3
  #install tools
  4
  install_tools()
  5
  {
  6
  echo -e "\033[32m \037Begin install tools,please waiting........\033[0m"
  7
  
  8
  yum install -y setuptool vim wget ntp ftp telnet openssh-clients make dstat ncurses-devel gcc gcc-c++ make libtool lrzsz >/dev/null 2>&1
  9
  
  10
  if [ $? -eq 0 ];then
  11
    echo -e "\033[32m \037The tools install finshed...\033[0m"
  12
  fi
  13
  }
  14
  
  15
  selinux()
  16
  {
  17
  #being selinux config
  18
  SELINUX_STATUS=`cat /etc/selinux/config  |grep '^SELINUX\>' |cut -d "=" -f2`
  19
  if [[ $SELINUX_STATUS == enforcing || $SELINUX_STATUS == permissive ]];then
  20
    sed -i "s/SELINUX=$SELINUX_STATUS/SELINUX=disabled/g" /etc/selinux/config
  21
      echo -e "Now selinux status is: \033[1;31m disable\033[0m."
  22
  else
  23
      echo -e "No change.The selinux status is: \033[1;35m disable\033[0m."
  24
  fi
  25
  }
  26
  
  27
  Time()
  28
  {
  29
  #time zone
  30
  TIME_ZONE=`cat /etc/sysconfig/clock |grep '^ZONE' |cut -d "=" -f2`
  31
  if [ $TIME_ZONE != \"Asia/Shanghai\" ];then
  32
  cat > /etc/sysconfig/clock <<EOF
  33
  ZONE="Asia/Shanghai"
  34
  UTC=false
  35
  ARC=false
  36
  EOF
  37
  
  38
    TIME_ZONE=`cat /etc/sysconfig/clock |grep '^ZONE' |cut -d "=" -f2`
  39
    echo -e "Now Time zone set success ,Zone now is: \"\033[1;31m$TIME_ZONE\033[0m\"."
  40
  else
  41
      echo -e "No change.Time zone is: \"\033[1;35m$TIME_ZONE\033[0m\"."
  42
  fi
  43
  
  44
  }
  45
  
  46
  ##time sync
  47
  time_sync()
  48
  {
  49
  time_dns='pool.ntp.org'
  50
  /usr/sbin/ntpdate  -s $time_dns
  51
  TIME=`date +%Y-%m-%d_%T`
  52
  export LANG=C
  53
  if [ $? -eq 0 ];then
  54
    echo -e "Sync time success.Now the time is: \"\033[1;32m$TIME\033[0m\""
  55
  fi
  56
  #sync time for bios
  57
  hwclock --systohc
  58
  
  59
  }
  60
  
  61
  ssh_port()
  62
  {
  63
  #change ssh login port
  64
  DE_SH=`cat /etc/ssh/sshd_config |grep 'Port\>' |head -c1`
  65
  DE_SH_PORT=`cat /etc/ssh/sshd_config |grep 'Port\>'`
  66
  if [ $DE_SH == \# ];then
  67
    sed -i s/"$DE_SH_PORT"/"Port 3322"/ /etc/ssh/sshd_config
  68
    SSH_PORT=`cat /etc/ssh/sshd_config |grep 'Port\>' |awk '{print $2}'`
  69
    if [ $SSH_PORT == 3322 ];then
  70
      echo -e "Now SSH port set success,port is: \"\033[1;31m$SSH_PORT\033[0m.\""
  71
    fi
  72
  else
  73
      SSH_PORT=`cat /etc/ssh/sshd_config |grep 'Port\>' |awk '{print $2}'`
  74
      if [ $SSH_PORT != 3322 ];then
  75
          sed -i s/"Port $SSH_PORT"/"Port 3322"/ /etc/ssh/sshd_config
  76
          echo -e "Now SSH port \"\033[1;31m$SSH_PORT\033[0m\" has change \"\033[1;31m63999\033[0m\"."
  77
      else
  78
        echo -e "No change SSH port is: \"\033[1;35m63999\033[0m\""
  79
      fi
  80
  fi
  81
  }
  82
  
  83
  ssh_root()
  84
  {
  85
  #delay root login
  86
  DEF_PER=`cat /etc/ssh/sshd_config |grep 'PermitRootLogin'   |grep -v 'without-password' |head -c 1`
  87
  DEF_PER_CON=`cat /etc/ssh/sshd_config |grep 'PermitRootLogin'   |grep -v 'without-password'`
  88
  if [ $DEF_PER == \# ];then
  89
    sed -i s/"$DEF_PER_CON"/"PermitRootLogin no"/ /etc/ssh/sshd_config
  90
      DEF_PER_CON1=`cat /etc/ssh/sshd_config |grep 'PermitRootLogin'   |grep -v 'without-password'`
  91
      echo -e "Now Root login permit set success.Now is: \"\033[1;31m$DEF_PER_CON1\033[0m\" ."
  92
  else
  93
      LOGIN_PER=`cat /etc/ssh/sshd_config |grep 'PermitRootLogin'   |grep -v 'without-password' |cut -d" " -f2`
  94
      if [ $LOGIN_PER == yes ];then
  95
         sed -i s/"PermitRootLogin yes"/"PermitRootLogin no"/ /etc/ssh/sshd_config
  96
         DEF_PER_CON2=`cat /etc/ssh/sshd_config |grep 'PermitRootLogin'   |grep -v 'without-password'`
  97
         echo -e "Now The permit is: \"\033[1;31m$DEF_PER_CON2\033[0m\" ."
  98
      else
  99
         echo -e "No change.The root login permit is: \"\033[1;35m no\033[0m\"."
  100
      fi
  101
  fi
  102
  }
  103
  
  104
  ssh_zip()
  105
  {
  106
  #open ssh zip
  107
  DEF_ZIP=`cat /etc/ssh/sshd_config |grep Compression  |head -c 1`
  108
  ZIP_STAT=`cat /etc/ssh/sshd_config |grep 'Compression'`
  109
  if [ $DEF_ZIP == \# ];then
  110
    sed -i s/"$ZIP_STAT"/"Compression yes"/  /etc/ssh/sshd_config
  111
    ZIP_STAT=`cat /etc/ssh/sshd_config |grep 'Compression'`
  112
    echo -e "Open zip for scp success.status is: \"\033[1;31m$ZIP_STAT\033[0m.\""
  113
  else
  114
    ZIP_STATUS=`cat /etc/ssh/sshd_config |grep 'Compression' |awk '{print $2}'`
  115
    if [ $ZIP_STATUS != yes ];then
  116
       sed -i s/"Compression $ZIP_STATUS"/"Compression yes"/  /etc/ssh/sshd_config
  117
      echo -e "Scp zip status: \"\033[1;31m$ZIP_STATUS\033[0m\" has change \"\033[1;31myes\033[0m\"."
  118
    else
  119
      echo -e "No change scp commpression status: \"\033[1;35myes\033[0m\""
  120
    fi
  121
  fi
  122
  }
  123
  
  124
  ssh_dns()
  125
  {
  126
  #close dns for ssh con
  127
  DEF_DNS=`cat /etc/ssh/sshd_config |grep 'UseDNS' |head -c 1`
  128
  DNS_STAT=`cat /etc/ssh/sshd_config |grep 'UseDNS'`
  129
  if [ $DEF_DNS == \# ];then
  130
    sed -i s/"$DNS_STAT"/"UseDNS no"/  /etc/ssh/sshd_config
  131
    DNS_STAT=`cat /etc/ssh/sshd_config |grep 'UseDNS'`
  132
    echo -e "Close dns for ssh.status is: \"\033[1;31m$DNS_STAT\033[0m.\""
  133
  else
  134
    DNS_STATUS=`cat /etc/ssh/sshd_config |grep 'UseDNS' |awk '{print $2}'`
  135
    if [ $ZIP_STATUS != no ];then
  136
       sed -i s/"Compression $ZIP_STATUS"/"Compression no"/  /etc/ssh/sshd_config
  137
      echo -e "DNS status: \"\033[1;31m$DNS_STATUS\033[0m\" has change \"\033[1;31mno\033[0m\"."
  138
    else
  139
      echo -e "No change UseDNS status: \"\033[1;35mno\033[0m\""
  140
    fi
  141
  fi
  142
  }
  143
  
  144
  ssh_startup()
  145
  {
  146
  #max start
  147
  START_MAX=`cat /etc/ssh/sshd_config |grep MaxStartups |head -c 1`
  148
  MAX_STAT=`cat /etc/ssh/sshd_config |grep MaxStartups`
  149
  if [ $DEF_DNS == \# ];then
  150
    sed -i s/"$MAX_STAT"/"MaxStartups 5"/  /etc/ssh/sshd_config
  151
    MAX_STAT=`cat /etc/ssh/sshd_config |grep MaxStartups`
  152
    echo -e "The max startups status is : \"\033[1;31m$MAX_STAT\033[0m.\""
  153
  fi
  154
  }
  155
  
  156
  ssh_emptypasswd()
  157
  {
  158
  #refuse empty passwd login
  159
  DEF_EMPTY=`cat /etc/ssh/sshd_config |grep PermitEmptyPasswords |head -c 1`
  160
  EMPTY_STAT=`cat /etc/ssh/sshd_config |grep PermitEmptyPasswords`
  161
  if [ $DEF_EMPTY == \# ];then
  162
    sed -i s/"$EMPTY_STAT"/"PermitEmptyPasswords no"/  /etc/ssh/sshd_config
  163
    EMPTY_STAT=`cat /etc/ssh/sshd_config |grep PermitEmptyPasswords`
  164
    echo -e "PermitEmptyPasswords status is: \"\033[1;31m$EMPTY_STAT\033[0m.\""
  165
  else
  166
    EMPTY_STATUS=`cat /etc/ssh/sshd_config |grep 'PermitEmptyPasswords' |awk '{print $2}'`
  167
    if [ $EMPTY_STATUS != no ];then
  168
       sed -i s/"PermitEmptyPasswords $EMPTY"/"PermitEmptyPasswords no"/  /etc/ssh/sshd_config
  169
      echo -e "PermitEmptyPasswords status: \"\033[1;31m$EMPTY_STATUS\033[0m\" has change \"\033[1;31mno\033[0m\"."
  170
    else
  171
      echo -e "No change PermitEmptyPasswords status: \"\033[1;35mno\033[0m\""
  172
    fi
  173
  fi
  174
  
  175
  }
  176
  
  177
  ssh_restart()
  178
  {
  179
  echo -e "\033[1;32m Begin restart sshd process....\033[0m"
  180
  systemctl restart sshd.service >/dev/null
  181
  if [ $? -eq 0 ];then
  182
    echo -e "\033[1;31m sshd_config set success. \033[0m"
  183
  fi
  184
  
  185
  }
  186
  
  187
  set_user()
  188
  {
  189
  #beging set user
  190
  NAME_COU=`cat /etc/passwd |grep '^test\>' |wc -l`
  191
  if [ $NAME_COU -eq 1 ];then
  192
      echo 'test123' | passwd --stdin "test" > /dev/null
  193
      echo -e "No change . The user name \"\033[1;35m test\033[0m \" exist,passwd has set again. please check out."
  194
  else
  195
     useradd test
  196
     echo 'test123' | passwd --stdin "test" > /dev/null
  197
     echo -e "Now Create username \"\033[1;31m test \033[0m\" && set passwd success."
  198
  fi
  199
  
  200
  #set root passwd
  201
  echo 'testroot' | passwd --stdin "root" > /dev/null
  202
  echo -e "Now \033[1;31m Root\033[0m passwd set success.."
  203
  
  204
  }
  205
  
  206
  profile_hist()
  207
  {
  208
  #begin set add time format for history
  209
  PRO_COUNT=`cat /etc/profile |grep 'HISTTIMEFORMAT' |wc -l`
  210
  if [ $PRO_COUNT -eq 0 ];then
  211
      /bin/sed -i "/^export PATH/a\export HISTTIMEFORMAT" /etc/profile
  212
      /bin/sed -i "/^HISTSIZE/a\HISTTIMEFORMAT=\"%Y-%m-%d %H:%M:%S: \"" /etc/profile
  213
      export HISTTIMEFORMAT
  214
      echo -e "Now The\033[1;31m history timeformat\033[0m set success now."
  215
  else
  216
      echo -e "No change.The\033[1;35m history timeformat\033[0m has setted ."
  217
  fi
  218
  }
  219
  
  220
  profile_other()
  221
  {
  222
  echo "TMOUT=1800" >> /etc/profile
  223
  echo "alias vi='vim'" >>/etc/profile
  224
  echo "unset MAILCHECK" >> /etc/profile
  225
  source /etc/profile
  226
  }
  227
  
  228
  run_level()
  229
  {
  230
  #begin set runlevel
  231
  RUNLEVEL=`cat /etc/inittab |grep '^id:.:initdefaul' |cut -d":" -f2`
  232
  if [ $RUNLEVEL != 3 ];then
  233
      /bin/sed -i  s/"id:$RUNLEVEL"/"id:3"/ /etc/inittab
  234
      NOW_RUNLEVEL=`cat /etc/inittab |grep '^id:.:initdefaul' |cut -d":" -f2`
  235
      echo -e "Now the runlevel is \"\033[1;31m$NOW_RUNLEVEL\033[0m\"."
  236
  else
  237
      echo -e "No change .The runlevel is \"\033[1;35m$RUNLEVEL\033[0m\"."
  238
  fi
  239
  }
  240
  
  241
  iptables()
  242
  {
  243
  ##begin set iptables start levle
  244
  systemctl disable  firewalld.service > /dev/null
  245
  echo -e "Now default \033[1;31m iptables\033[0m start runlevel all set off "
  246
  systemctl stop firewalld.service > /dev/null
  247
  }
  248
  
  249
  unnecessary_service()
  250
  {
  251
  #begin turn off unnecessary services
  252
  export LANG=C
  253
  echo -e "\e[32m begin turn off unnecessary services.....\e[0m"
  254
  for close_list in `chkconfig --list |awk '($5~/on/ || $7~/on/) {print $1}' | grep -vE "atd|crond|cpuspeed|irqbalance|lvm2-monitor|network|smartd|sshd|syslog|sysstat"`
  255
  do
  256
    echo $close_list
  257
    /sbin/chkconfig --level 2345 $close_list off
  258
    /sbin/service $close_list stop >/dev/null
  259
  done
  260
  echo -e "Now The \033[1;31m unnecessary services \033[0m turn off now."
  261
  #echo -e "\e[32m----------------End  system initialization ---------------\e[0m"
  262
  }
  263
  
  264
  ##set sysctl.conf
  265
  
  266
  sysctl_set()
  267
  {
  268
  cat >> /etc/sysctl.conf <<EOF
  269
  ###################################################
  270
  vm.overcommit_memory = 1
  271
  ###################################################
  272
  net.netfilter.nf_conntrack_max=1000000
  273
  ###################################################
  274
  net.core.rmem_default = 126976
  275
  net.core.wmem_default = 126976
  276
  net.core.wmem_max = 16777216
  277
  net.core.rmem_max = 16777216
  278
  net.ipv4.tcp_mem = 8192 87380 16777216
  279
  net.ipv4.tcp_wmem = 8192 65536 16777216
  280
  net.ipv4.tcp_rmem = 8192 87380 16777216
  281
  ###################################################
  282
  net.core.netdev_max_backlog = 2500
  283
  net.core.somaxconn = 100000
  284
  ###################################################
  285
  net.ipv4.tcp_no_metrics_save = 0
  286
  net.ipv4.tcp_moderate_rcvbuf = 1
  287
  net.ipv4.tcp_orphan_retries= 1
  288
  net.ipv4.tcp_fin_timeout = 5
  289
  net.ipv4.tcp_keepalive_time = 300
  290
  net.ipv4.tcp_syncookies = 1
  291
  net.ipv4.tcp_sack = 1
  292
  net.ipv4.tcp_tw_reuse = 1
  293
  net.ipv4.tcp_tw_recycle = 1
  294
  net.ipv4.ip_local_port_range = 10250 65000
  295
  net.ipv4.tcp_max_syn_backlog = 81920
  296
  net.ipv4.tcp_max_tw_buckets = 1600000
  297
  net.ipv4.tcp_synack_retries = 2
  298
  net.ipv4.tcp_syn_retries = 2
  299
  net.ipv4.tcp_retries2 = 2
  300
  net.ipv4.tcp_window_scaling = 1
  301
  net.ipv4.tcp_timestamps = 1
  302
  ###################################################
  303
  fs.file-max = 1024000
  304
  EOF
  305
  
  306
  sysctl -p >/dev/null 2>1&
  307
  
  308
  }
  309
  
  310
  #limit file
  311
  limit_file()
  312
  {
  313
  cat >> /etc/security/limits.conf <<EOF
  314
  *                hard    nofile         1024000
  315
  *                soft    nofile         1024000
  316
  *                hard    nproc          1024000
  317
  *                soft    nproc          1024000
  318
  EOF
  319
  }
  320
  
  321
  sudu_log()
  322
  {
  323
  touch /var/log/sudo.log
  324
  cat >> /etc/sudoers <<EOF
  325
  LocoJoyUser    ALL=(ALL)       NOPASSWD: /bin/sh
  326
  Defaults logfile=/var/log/sudo.log
  327
  EOF
  328
  
  329
  cat >> /etc/rsyslog.conf <<EOF
  330
  local8.debug    /var/log/sudo.log
  331
  EOF
  332
  }
  333
  
  334
  echo -e "\e[32m----------------Begin  system initialization ---------------\e[0m"
  335
  echo
  336
  install_tools
  337
  selinux
  338
  #Time
  339
  time_sync
  340
  ssh_port
  341
  ssh_root
  342
  ssh_zip
  343
  ssh_dns
  344
  ssh_startup
  345
  ssh_emptypasswd
  346
  ssh_restart
  347
  set_user
  348
  profile_hist
  349
  profile_other
  350
  #run_level
  351
  iptables
  352
  #unnecessary_service
  353
  sysctl_set
  354
  limit_file
  355
  sudu_log
  356
  echo
  357
  echo -e "\e[32m----------------End  system initialization ---------------\e[0m"

  展开收起