– 内核级负载均衡：在Linux内核中实现，性能极高
– 四层负载均衡：支持TCP/UDP协议
– 多种调度算法：轮询、加权轮询、最少连接等
– 三种工作模式：NAT、DR、TUN
– 高可用支持：与Keepalived配合实现高可用
– 可扩展性：支持大规模服务器集群
– 透明代理：对客户端透明
– 会话保持：支持持久化连接
– 健康检查：与Keepalived配合实现健康检查

LVS工作模式对比：

模式 特点 性能 配置复杂度 适用场景
NAT 请求响应都经过LVS 中等 简单 小规模集群
DR 响应直接返回客户端 高 中等 大规模集群
TUN 通过IP隧道转发 高 复杂 跨网段集群

DR模式性能最高，是生产环境推荐的工作模式。

组件 版本 说明
ip_vs 内核集成 Linux内核2.4+已集成
ipvsadm 1.31 用户空间管理工具
keepalived 2.3.x 高可用管理软件

ipvsadm 1.31主要特性：
– 支持所有IPVS内核功能
– 支持IPv6
– 支持多种调度算法
– 支持持久化服务
– 支持防火墙标记

官方下载地址：

LVS官网：http://www.linuxvirtualserver.org/
ipvsadm下载：http://www.linuxvirtualserver.org/software/ipvs.html
Keepalived官网：https://www.keepalived.org/
内核文档：https://www.kernel.org/doc/Documentation/networking/ipvs-sysctl.rst

CentOS/RHEL安装：
# yum install -y ipvsadm

输出示例如下：
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
–> Running transaction check
—> Package ipvsadm.x86_64 0:1.31-1.el7 will be installed
–> Finished Dependency Resolution

Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
ipvsadm x86_64 1.31-1.el7 base 45 k

Transaction Summary
================================================================================
Install 1 Package

Total download size: 45 k
Installed size: 85 k
Downloading packages:
ipvsadm-1.31-1.el7.x86_64.rpm | 45 kB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : ipvsadm-1.31-1.el7.x86_64 1/1
Verifying : ipvsadm-1.31-1.el7.x86_64 1/1

Installed:
ipvsadm.x86_64 0:1.31-1.el7

Complete!

Ubuntu/Debian安装：
# apt update
# apt install -y ipvsadm

输出示例如下：
Reading package lists… Done
Building dependency tree… Done
The following NEW packages will be installed:
ipvsadm
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 45.0 kB of archives.
After this operation, 85.0 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy/main amd64 ipvsadm amd64 1.31-1 [45.0 kB]
Fetched 45.0 kB in 1s (45.0 kB/s)
Selecting previously unselected package ipvsadm…
(Reading database … 123456 files and directories currently installed.)
Preparing to unpack …/ipvsadm_1.31-1_amd64.deb …
Unpacking ipvsadm (1.31-1) …
Setting up ipvsadm (1.31-1) …

验证安装：
$ ipvsadm –version

输出示例如下：
ipvsadm v1.31 2025/01/15 (compiled with popt and IPVS v1.2.1)

方式二：源码编译安装

下载源码包：
$ cd /fgeudb/software
$ wget https://kernel.org/pub/linux/utils/kernel/ipvsadm/ipvsadm-1.31.tar.gz

输出示例如下：
–2026-04-04 10:00:00– https://kernel.org/pub/linux/utils/kernel/ipvsadm/ipvsadm-1.31.tar.gz
Resolving kernel.org… 139.178.84.217
Connecting to kernel.org|139.178.84.217|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 45678 (45K) [application/octet-stream]
Saving to: ‘ipvsadm-1.31.tar.gz’

ipvsadm-1.31.tar.gz 100%[======================================================================>] 44.61K 125KB/s in 0.4s

2026-04-04 10:00:01 (125 KB/s) – ‘ipvsadm-1.31.tar.gz’ saved [45678/45678]

解压源码包：
$ tar -zxvf ipvsadm-1.31.tar.gz -C /fgeudb/

安装编译依赖：
# yum install -y gcc make popt-devel libnl3-devel

或Ubuntu/Debian：
# apt install -y build-essential libpopt-dev libnl-3-dev

编译安装：
$ cd /fgeudb/ipvsadm-1.31
$ make
# make install

输出示例如下：
gcc -Wall -Wunused -Wstrict-prototypes -g -DVERSION=\”1.31\” …
install -m 0755 -s ipvsadm /usr/sbin
install -m 0755 ipvsadm-save /usr/sbin
install -m 0755 ipvsadm-restore /usr/sbin

方式三：安装Keepalived

CentOS/RHEL安装Keepalived：
# yum install -y keepalived

输出示例如下：
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
–> Running transaction check
—> Package keepalived.x86_64 0:2.3.2-1.el7 will be installed
–> Finished Dependency Resolution

Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
keepalived x86_64 2.3.2-1.el7 base 350 k

Transaction Summary
================================================================================
Install 1 Package

Total download size: 350 k
Installed size: 850 k
Downloading packages:
keepalived-2.3.2-1.el7.x86_64.rpm | 350 kB 00:00:01
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : keepalived-2.3.2-1.el7.x86_64 1/1
Verifying : keepalived-2.3.2-1.el7.x86_64 1/1

Installed:
keepalived.x86_64 0:2.3.2-1.el7

Complete!

Ubuntu/Debian安装Keepalived：
# apt install -y keepalived

验证安装：
$ keepalived -v

输出示例如下：
Keepalived v2.3.2 (01/15,2025)

Copyright(C) 2001-2025 Alexandre Cassen, <acassen@gmail.com>

Built with kernel headers for Linux 5.15.0
Running on Linux 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023

configure options: –build=x86_64-linux-gnu …

Config options: LVS VRRP VRRP_AUTH OLD_CHKSUM_COMPAT FIB_ROUTING

System options: PIPE2 SIGNALFD INOTIFY_INIT1 VSYSLOG EPOLL_CREATE1 IPV4_DEVCONF IPV6_ADVANCED_MODEL RTA_ENCAP RTA_EXPIRES RTA_PREF FRA_SUPPRESS_PREFIX FRA_SUPPRESS_IFGROUP RTAX_QUICKACK FRA_UID_RANGE RTA_VIA FRA_OIFNAME RTA_TTL_PROPAGATE IFA_FLAGS IP_MULTICAST_ALL NET_LINUX_IF_H_COLLISION LIBIPTC_LINUX_NET_IF_H_COLLISION LIBIPVS_NETLINK IPVS_DEST_ATTR_ADDR_FAMILY IPVS_SYNCD_ATTRIBUTES IPVS_64BIT_STATS IPVS_TUN_TYPE IPVS_TUN_CSUM IPVS_TUN_GRE VRRP_IPVLAN FAILOVER_STATE_DUMP FAILOVER_STATE_DUMP_V4 FAILOVER_STATE_DUMP_V6

检查IPVS模块是否已加载：
$ lsmod | grep ip_vs

输出示例如下：
ip_vs 155648 0
nf_conntrack 143360 1 ip_vs
libcrc32c 16384 2 nf_conntrack,ip_vs

加载IPVS模块：
# modprobe ip_vs
# modprobe ip_vs_rr
# modprobe ip_vs_wrr
# modprobe ip_vs_sh

设置开机自动加载：
# vi /etc/modules-load.d/ipvs.conf

ip_vs
ip_vs_rr
ip_vs_wrr
ip_vs_sh

查看IPVS模块信息：
$ modinfo ip_vs

输出示例如下：
filename: /lib/modules/5.15.0-91-generic/kernel/net/netfilter/ipvs/ip_vs.ko
license: GPL
srcversion: ABC123DEF456
depends: nf_conntrack
retpoline: Y
name: ip_vs
vermagic: 5.15.0-91-generic SMP mod_unload modversions

步骤2：配置系统参数

配置内核参数：
# vi /etc/sysctl.conf

IPVS相关参数：
net.ipv4.ip_forward = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2
net.ipv4.vs.conn_reuse_mode = 0
net.ipv4.vs.conntrack = 1

使配置生效：
# sysctl -p

输出示例如下：
net.ipv4.ip_forward = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2
net.ipv4.vs.conn_reuse_mode = 0
net.ipv4.vs.conntrack = 1

网络拓扑：
– VIP（虚拟IP）：192.168.1.100
– LVS Director：192.168.1.51
– Real Server 1：192.168.1.52
– Real Server 2：192.168.1.53
– Real Server 3：192.168.1.54

在LVS Director上配置虚拟服务：
创建虚拟服务：
# ipvsadm -A -t 192.168.1.100:80 -s rr

添加Real Server：
# ipvsadm -a -t 192.168.1.100:80 -r 192.168.1.52:80 -g -w 3
# ipvsadm -a -t 192.168.1.100:80 -r 192.168.1.53:80 -g -w 2
# ipvsadm -a -t 192.168.1.100:80 -r 192.168.1.54:80 -g -w 1

参数说明：
-A：添加虚拟服务
-t：TCP服务
-s：调度算法（rr=轮询，wrr=加权轮询，lc=最少连接）
-a：添加Real Server
-r：Real Server地址
-g：DR模式（-m=NAT模式，-i=TUN模式）
-w：权重

查看配置：
# ipvsadm -Ln

输出示例如下：
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.1.100:80 rr
-> 192.168.1.52:80 Route 3 0 0
-> 192.168.1.53:80 Route 2 0 0
-> 192.168.1.54:80 Route 1 0 0

配置VIP地址：
# ip addr add 192.168.1.100/32 dev eth0

步骤2：在Real Server上配置

在每台Real Server上配置VIP（用于DR模式）：

配置ARP参数：
# vi /etc/sysctl.conf

net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2

使配置生效：
# sysctl -p

配置VIP到lo接口：
# ip addr add 192.168.1.100/32 dev lo

配置路由：
# route add -host 192.168.1.100 dev lo

创建配置脚本：
# vi /fgeudb/scripts/realserver.sh

#!/bin/bash
VIP=192.168.1.100

case “$1” in
start)
ip addr add $VIP/32 dev lo
echo “1” > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo “2” > /proc/sys/net/ipv4/conf/lo/arp_announce
echo “1” > /proc/sys/net/ipv4/conf/all/arp_ignore
echo “2” > /proc/sys/net/ipv4/conf/all/arp_announce
echo “Real Server started”
;;
stop)
ip addr del $VIP/32 dev lo
echo “0” > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo “0” > /proc/sys/net/ipv4/conf/lo/arp_announce
echo “0” > /proc/sys/net/ipv4/conf/all/arp_ignore
echo “0” > /proc/sys/net/ipv4/conf/all/arp_announce
echo “Real Server stopped”
;;
*)
echo “Usage: $0 {start|stop}”
exit 1
esac

设置执行权限：
# chmod +x /fgeudb/scripts/realserver.sh

启动配置：
# /fgeudb/scripts/realserver.sh start

步骤3：配置NAT模式负载均衡

创建NAT模式虚拟服务：
# ipvsadm -A -t 192.168.1.100:80 -s wrr
# ipvsadm -a -t 192.168.1.100:80 -r 10.0.0.2:80 -m -w 3
# ipvsadm -a -t 192.168.1.100:80 -r 10.0.0.3:80 -m -w 2
# ipvsadm -a -t 192.168.1.100:80 -r 10.0.0.4:80 -m -w 1

参数说明：
-m：NAT模式

开启IP转发：
# echo 1 > /proc/sys/net/ipv4/ip_forward

配置NAT规则：
# iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

查看NAT模式配置：
# ipvsadm -Ln

输出示例如下：
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.1.100:80 wrr
-> 10.0.0.2:80 Masq 3 0 0
-> 10.0.0.3:80 Masq 2 0 0
-> 10.0.0.4:80 Masq 1 0 0

创建Keepalived配置文件：
# vi /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
router_id LVS_MASTER
vrrp_skip_check_adv_addr
vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
}

vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.1.100/32 dev eth0
}
}

virtual_server 192.168.1.100 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP

real_server 192.168.1.52 80 {
weight 3
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}

real_server 192.168.1.53 80 {
weight 2
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}

real_server 192.168.1.54 80 {
weight 1
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
}

启动Keepalived：
# systemctl start keepalived
# systemctl enable keepalived

步骤2：配置Keepalived备节点

创建Keepalived配置文件：
# vi /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
router_id LVS_BACKUP
vrrp_skip_check_adv_addr
vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
}

vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.1.100/32 dev eth0
}
}

virtual_server 192.168.1.100 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP

real_server 192.168.1.52 80 {
weight 3
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}

real_server 192.168.1.53 80 {
weight 2
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}

real_server 192.168.1.54 80 {
weight 1
TCP_CHECK {
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
}

启动Keepalived：
# systemctl start keepalived
# systemctl enable keepalived

查看虚拟服务：
# ipvsadm -Ln

输出示例如下：
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 192.168.1.100:80 rr persistent 50
-> 192.168.1.52:80 Route 3 10 5
-> 192.168.1.53:80 Route 2 8 3
-> 192.168.1.54:80 Route 1 5 2

查看连接统计：
# ipvsadm -Ln –stats

输出示例如下：
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Conns InPkts OutPkts InBytes OutBytes
-> RemoteAddress:Port
TCP 192.168.1.100:80 1234 56789 12345 1234567 234567
-> 192.168.1.52:80 500 23456 5678 567890 98765
-> 192.168.1.53:80 400 18765 4567 456789 78901
-> 192.168.1.54:80 334 14568 2100 209888 56901

查看速率统计：
# ipvsadm -Ln –rate

输出示例如下：
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port CPS InPPS OutPPS InBPS OutBPS
-> RemoteAddress:Port
TCP 192.168.1.100:80 10 567 123 12345 23456
-> 192.168.1.52:80 4 234 56 5678 9876
-> 192.168.1.53:80 3 187 45 4567 7890
-> 192.168.1.54:80 3 146 22 2100 5690

访问测试

测试VIP访问：
$ curl -I http://192.168.1.100

输出示例如下：
HTTP/1.1 200 OK
Date: Fri, 04 Apr 2026 10:10:00 GMT
Server: nginx
Content-Type: text/html
Content-Length: 1234

测试会话保持：
$ for i in {1..10}; do curl -s http://192.168.1.100 | grep “Server”; done

输出示例如下：
Server: Real Server 1
Server: Real Server 1
Server: Real Server 1
…

测试负载均衡：
$ for i in {1..10}; do curl -s http://192.168.1.100 | grep “Server”; done

输出示例如下（轮询模式）：
Server: Real Server 1
Server: Real Server 2
Server: Real Server 3
Server: Real Server 1
…

Keepalived状态检查

查看Keepalived状态：
# systemctl status keepalived

输出示例如下：
● keepalived.service – LVS and VRRP High Availability Monitor
Loaded: loaded (/usr/lib/systemd/system/keepalived.service; enabled)
Active: active (running) since Fri 2026-04-04 10:05:00 CST; 10min ago
Main PID: 12345 (keepalived)
CGroup: /system.slice/keepalived.service
├─12345 /usr/sbin/keepalived -D
└─12346 /usr/sbin/keepalived -D

查看VIP绑定：
$ ip addr show eth0 | grep 192.168.1.100

输出示例如下（主节点）：
inet 192.168.1.100/32 scope global eth0

查看VRRP状态：
# journalctl -u keepalived -f

症状：ipvsadm: Can’t initialize ipvs: Protocol not available

解决方案：
1. 检查内核是否支持IPVS：
$ grep -i ipvs /boot/config-$(uname -r)

2. 手动加载模块：
# modprobe ip_vs

3. 设置开机自动加载：
# echo “ip_vs” >> /etc/modules

4. 检查模块是否加载：
$ lsmod | grep ip_vs

问题2：Real Server无法访问

症状：客户端无法连接到Real Server

解决方案：
1. 检查Real Server健康状态：
# ipvsadm -Ln

2. 检查Real Server配置：
– 确保VIP配置正确
– 确保ARP参数配置正确
– 确保服务正常运行

3. 检查网络连通性：
$ ping 192.168.1.52
$ telnet 192.168.1.52 80

4. 检查防火墙：
# firewall-cmd –list-all
# firewall-cmd –add-port=80/tcp –permanent
# firewall-cmd –reload

问题3：VIP漂移失败

症状：主节点故障后VIP未漂移到备节点

解决方案：
1. 检查Keepalived配置：
– 确保virtual_router_id一致
– 确保认证密码一致
– 确保优先级设置正确

2. 检查VRRP通信：
$ tcpdump -i eth0 vrrp -n

3. 检查防火墙：
# firewall-cmd –add-protocol=vrrp –permanent
# firewall-cmd –reload

4. 查看Keepalived日志：
# journalctl -u keepalived -n 100

问题4：会话保持不生效

症状：同一客户端请求被分发到不同服务器

解决方案：
1. 配置持久化服务：
# ipvsadm -A -t 192.168.1.100:80 -s rr -p 300

2. 在Keepalived中配置：
virtual_server 192.168.1.100 80 {
persistence_timeout 300
…
}

3. 使用源地址哈希调度：
# ipvsadm -A -t 192.168.1.100:80 -s sh

4. 检查会话保持时间：
# ipvsadm -Ln –persistent-conn

LVS管理命令

查看所有虚拟服务：
# ipvsadm -Ln

查看统计信息：
# ipvsadm -Ln –stats
# ipvsadm -Ln –rate

添加虚拟服务：
# ipvsadm -A -t VIP:PORT -s 调度算法

删除虚拟服务：
# ipvsadm -D -t VIP:PORT

添加Real Server：
# ipvsadm -a -t VIP:PORT -r RIP:PORT -g -w 权重

删除Real Server：
# ipvsadm -d -t VIP:PORT -r RIP:PORT

修改Real Server权重：
# ipvsadm -e -t VIP:PORT -r RIP:PORT -g -w 新权重

保存配置：
# ipvsadm-save > /etc/sysconfig/ipvsadm
或
# ipvsadm -S > /etc/sysconfig/ipvsadm

恢复配置：
# ipvsadm-restore < /etc/sysconfig/ipvsadm 或 # ipvsadm -R < /etc/sysconfig/ipvsadm 清空所有配置： # ipvsadm -C 查看帮助： # ipvsadm --help