Haproxy实现Exchange全透明代理服务

公司最近Exchange邮件系统来构建高可用邮件系统架构。前端负载均衡就是使用了微软的NLB来实现cas的负载均衡。但是方案实施工程中也发现了一些问题，使用NLB在网络中产生大量广播报，出现丢包严重问题。后改用haproxy替代NLB实现cas的负载均衡，但也这就导致了一个问题，最明显的就是用户通过Haproxy来访问邮件系统后 真正达到邮件系统的地址都是Haproxy的地址，在垃圾邮件过滤的时候就无法实现基于IP的过滤，并且也无法记录IP地址信息。为 了解决这个问题我google了很多方案，可以使用硬负载，硬负载可以实现全透明代理让后端邮件服务器获取到用户的真实IP，还有一种解决方案就是 Haproxy的全透明代理。接下来将会介绍下Haproxy的全透明代理的部署。

Haproxy+Keepalived搭建Weblogic高可用负载均衡集群

Keepalived+HAProxy配置高可用负载均衡

CentOS 6.3下Haproxy+Keepalived+Apache配置笔记

Haproxy + KeepAlived 实现WEB群集 on CentOS 6

Haproxy+Keepalived构建高可用负载均衡

二:实验拓扑

三:方案部署

配置Haproxy

#!/bin/bash
wget
tar zxvf haproxy-1.4.25.tar.gz
cd haproxy-1.4.25
yum install gcc gcc-c++ autoconf automake -y
make TARGET=linux2628 arch=x86_64 USE_LINUX_TPROXY=1 #重点USE_LINUX_TPROXY=1用于编译支持TPTOXY
make install
mkdir /etc/haproxy
cp examples/haproxy.cfg /etc/haproxy
cp examples/haproxy.init /etc/init.d/haproxy
chmod +x /etc/init.d/haproxy
cp haproxy /usr/sbin/

修改配置文件/etc/haproxy/haproxy.cfg
global
log 127.0.0.1  local0
maxconn 409600
chroot /usr/local/share
#  uid 501
#  gid 501
daemon
nbproc 1
pidfile /usr/local/haproxy/logs/haproxy.pid
#  debug
defaults
log global
maxconn 100000
contimeout 500000
clitimeout 3600000
srvtimeout 3600000
option redispatch
retries 6
frontend mail.domain.com
mode http
bind 0.0.0.0:80
log global
option tcplog
redirect location https://mail.domain.com/owa
frontend owa_443
mode tcp
bind 0.0.0.0:443
default_backend pool_443
log global
option tcplog
backend  pool_443
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
source 0.0.0.0  usesrc clientip #重点,TPROXY需要加上这行。
server cas01 10.130.170.130:443 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:443 check inter 5000 weight 1 rise 2 fall 3
frontend smtp_25
mode tcp
bind 0.0.0.0:25
default_backend pool_smtp
log global
option tcplog
backend pool_smtp
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
source 0.0.0.0  usesrc clientip #重点,TPROXY需要加上这行。
server cas01 10.130.170.130:25 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:25 check inter 5000 weight 1 rise 2 fall 3
frontend pop_995
mode tcp
bind 0.0.0.0:995
default_backend pool_pop
log global
option tcplog
backend pool_pop
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas01 10.130.170.130:995 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:995 check inter 5000 weight 1 rise 2 fall 3
frontend pop_993
mode tcp
bind 0.0.0.0:993
default_backend pool_993
log global
option tcplog
backend pool_993
balance source
#  option forwardfor
#  option originalto
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas01 10.130.170.130:993 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:993 check inter 5000 weight 1 rise 2 fall 3
frontend pop_135
mode tcp
bind 0.0.0.0:135
default_backend pool_135
log global
option tcplog
backend pool_135
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas01 10.130.170.130:135 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:135 check inter 5000 weight 1 rise 2 fall 3
frontend pop_593
mode tcp
bind 0.0.0.0:593
default_backend pool_593
log global
option tcplog
backend pool_593
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas01 10.130.170.130:593 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:593 check inter 5000 weight 1 rise 2 fall 3
frontend pop_60001
mode tcp
bind 0.0.0.0:60001
default_backend pool_60001
log global
option tcplog
backend pool_60001
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas02 10.130.170.130:60001 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:60001 check inter 5000 weight 1 rise 2 fall 3
frontend pop_55000
mode tcp
bind 0.0.0.0:55000
default_backend pool_55000
log global
option tcplog
backend pool_55000
balance source
option redispatch
option abortonclose
option persist
stick on src
stick-table type ip size 10240k expire 240m
server cas02 10.130.170.130:55000 check inter 5000 weight 1 rise 2 fall 3
server cas02 10.130.170.131:55000 check inter 5000 weight 1 rise 2 fall 3
frontend vs_stats :8081
mode http
log global
option httplog
default_backend stats_backend
backend stats_backend
mode http
stats enable
stats uri /stats
stats auth admin:admin

3.由于ExchangeRPC的端口是动态端口，haproxy必须使用固定端口，我这里改成了60001和55000，修改注册表即可，这里不做介绍。

4.配置TProxy代码如下vi iptables.sh