Linux学习之旅之反向代理与负载均衡一、认识代理对比维度正向代理反向代理核心定义代理客户端访问外网服务器服务器不知道真实客户端是谁代理后端服务对外提供访问客户端不知道真实后端服务器是谁代理对象客户端替用户上网服务端替业务服务器接收请求视角区分站在服务器视角来访的是代理看不到真实用户站在客户端视角访问的是代理看不到真实业务服务典型位置内网客户端 ↔ 代理服务器 ↔ 公网目标网站公网用户 ↔ 反向代理服务器 ↔ 内网后端集群IP 隐藏效果隐藏客户端真实 IP目标服务器只看到代理 IP隐藏后端服务器真实 IP客户端只看到代理 IP访问逻辑举例公司员工客户端→公司代理服务器→百度百度只能看到代理服务器 IP不知道员工内网 IP用户浏览器→Nginx 反向代理→后端服务 A / 服务 B用户只知道 Nginx 域名不清楚后端多台业务机器安全作用对内网客户端做隔离外网无法直接访问内网用户对内网业务服务器做隔离外网不能直连后端只暴露代理入口域名 / 访问特征客户端需要手动配置代理地址才能生效客户端正常访问域名无需任何额外配置代理对用户透明二、部署反向代理1、环境准备2、安装Nginx#安装Nginx参考上文《19-Linux学习之旅之Nginx认知和部署》第二步骤https://blog.csdn.net/2401_88082755/article/details/163781778?sharetypeblogdetailsharerId163781778sharereferPCsharesource2401_88082755spm1011.2480.3001.81183、基础配置#创建网站目录[rootbackend1 ~]# mkdir -p /var/www/backend/api#创建网站文件[rootbackend1 ~]# echo Backend 1 (10.0.0.21) /var/w ww/backend/index.html[rootbackend1 ~]# echo {code:200,data:Backend 1} /var/www/backend/api/user#创建虚拟主机[rootbackend1 ~]# cat /etc/nginx/conf.d/backend.conf EOFserver{listen8080;server_name backend;root /var/www/backend;index index.html;access_log /var/log/nginx/backend_access.log main;error_log /var/log/nginx/backend_error.log warn;}EOF#检查配置文件和重新加载配置[rootbackend1 ~]# nginx -t systemctl reload nginxnginx: the configurationfile/etc/nginx/nginx.conf synt ax is ok nginx: configurationfile/etc/nginx/nginx.conftestis successful#主机backend2和3配置需要将10.0.0.21改成10.0.0.22/23Backend 1改成Backend2/3echoBackend 1 (10.0.0.21)/var/www/backend/index.htmlecho{code:200,data:Backend 1}/var/www/backend/api/user#在LB1测试后端服务200 OK表示正常[rootLB1 ~]# curl -I http://10.0.0.21:8080HTTP/1.1200OK Server: nginx/1.30.4 Date: Tue,11Aug202609:09:00 GMT Content-Type: text/html Content-Length:22Last-Modified: Tue,11Aug202609:06:20 GMT Connection: keep-alive ETag:6a7ae60c-16Accept-Ranges: bytes[rootLB1 ~]# curl -I http://10.0.0.22:8080HTTP/1.1200OK Server: nginx/1.30.4 Date: Tue,11Aug202609:09:04 GMT Content-Type: text/html Content-Length:22Last-Modified: Tue,11Aug202609:07:32 GMT Connection: keep-alive ETag:6a7ae654-16Accept-Ranges: bytes[rootLB1 ~]# curl -I http://10.0.0.23:8080HTTP/1.1200OK Server: nginx/1.30.4 Date: Tue,11Aug202609:09:07 GMT Content-Type: text/html Content-Length:22Last-Modified: Tue,11Aug202609:07:46 GMT Connection: keep-alive ETag:6a7ae662-16Accept-Ranges: bytes#准备LB静态资源[rootLB1 ~]# mkdir -p /var/www/nginx/images[rootLB1 ~]# echo LB Home Page /var/www/nginx/index.html[rootLB1 ~]# echo LB Test Page /var/www/nginx/test.html4、配置负载均衡#创建负载均衡[rootLB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf[rootLB1 ~]# cat /etc/nginx/conf.d/proxy-lb.conf#负载均衡upstream backend{server10.0.0.21:8080;server10.0.0.22:8080;server10.0.0.23:8080;}server{listen80;server_name lb.xyx.com;root /var/www/nginx;# 静态资源LB 直接返回location ~*\.(jpg|jpeg|png|gif|ico|svg|webp|css|js)${expires 30d;access_log off;}# API 请求转发到后端负载均衡location /api/{proxy_pass http://backend;# 传递真实客户端信息proxy_set_header Host$host;# 原始 Hostproxy_set_header X-Real-IP$remote_addr;# 客户端真实 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# 代理链proxy_set_header X-Forwarded-Proto$scheme;# 原始协议(http/https)}# 其他请求LB 直接返回静态文件location /{try_files$uri$uri/ /index.html;}}#检查配置文件和重新加载配置文件[rootLB1 ~]# nginx -t systemctl reload nginxnginx: the configurationfile/etc/nginx/nginx.conf syntax is ok nginx: configurationfile/etc/nginx/nginx.conftestis successful5、验证负载均衡#单一测试rootubt2604ser:~# curl -s http://lb.xyx.com/api/user{code:200,data:Backend 1}#循环测试rootubt2604ser:~# for i in {1..6}; do curl -s http://lb.xyx.com/api/user; done{code:200,data:Backend 1}{code:200,data:Backend 2}{code:200,data:Backend 3}{code:200,data:Backend 1}{code:200,data:Backend 2}{code:200,data:Backend 3}#查看backend1连接日志[rootbackend1 ~]# tail -f /var/log/nginx/access.log10.0.0.11 - -[12/Aug/2026:08:26:50 0800]GET /api/user HTTP/1.120032-curl/8.18.010.0.0.410.0.0.11 - -[12/Aug/2026:08:26:50 0800]GET /api/user HTTP/1.120032-curl/8.18.010.0.0.46、负载均衡#添加权重weight分流参数3:1:1[rootLB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf[rootLB1 ~]# cat /etc/nginx/conf.d/proxy-lb.confupstream backend{server10.0.0.21:8080weight3;server10.0.0.22:8080weight1;server10.0.0.23:8080weight1;}#检验和加载[rootLB1 ~]# nginx -tnginx: the configurationfile/etc/nginx/nginx.conf syntax is ok nginx: configurationfile/etc/nginx/nginx.conftestis successful[rootLB1 ~]# systemctl reload nginx.service#验证rootubt2604ser:~# for i in {1..6}; do curl -s http://lb.xyx.com/api/user; done{code:200,data:Backend 1}{code:200,data:Backend 2}{code:200,data:Backend 1}{code:200,data:Backend 3}{code:200,data:Backend 1}{code:200,data:Backend 1}#查看三台backend日志发现backend1的连接更多[rootbackend1 ~]# tail -f /var/log/nginx/backend_access.log10.0.0.11 - -[12/Aug/2026:08:32:58 0800]GET /api/user HTTP/1.120032-curl/8.18.010.0.0.410.0.0.11 - -[12/Aug/2026:08:32:58 0800]GET /api/user HTTP/1.120032-curl/8.18.010.0.0.410.0.0.11 - -[12/Aug/2026:08:32:58 0800]GET /api/user HTTP/1.120032-curl/8.18.010.0.0.4##ip_hash(会话保持)传统应用使用本地 Session同一用户必须访问同一后端。[rootLB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf[rootLB1 ~]# cat /etc/nginx/conf.d/proxy-lb.confupstream backend{ip_hash;server10.0.0.21:8080;server10.0.0.22:8080;server10.0.0.23:8080;}#查看backend主机日志会发现都会在一台##least_conn(最少连接)传统应用使用本地 Session同一用户必须访问同一后端。[rootLB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf[rootLB1 ~]# cat /etc/nginx/conf.d/proxy-lb.confupstream backend{least_conn;server10.0.0.21:8080;server10.0.0.22:8080;server10.0.0.23:8080;}#三台backend主机日志上连接很平均7、被动健康检查[rootLB1 ~]# vim /etc/nginx/conf.d/proxy-lb.conf[rootLB1 ~]# cat /etc/nginx/conf.d/proxy-lb.confupstream backend{server10.0.0.21:8080max_fails3fail_timeout30s;server10.0.0.22:8080max_fails3fail_timeout30s;server10.0.0.23:8080max_fails3fail_timeout30s;}#max_fails3失败三次后标记为不可用#fail_timeout30s不可用后30秒在重试连接[rootLB1 ~]# nginx -t systemctl reload nginx.servicenginx: the configurationfile/etc/nginx/nginx.conf syntax is ok nginx: configurationfile/etc/nginx/nginx.conftestis successful[rootLB1 ~]##模拟故障[rootbackend2 ~]# systemctl stop nginx.servicerootubt2604ser:~# for i in {1..6}; do curl -s http://lb.xyx.com/api/user; done{code:200,data:Backend 1}{code:200,data:Backend 3}{code:200,data:Backend 3}{code:200,data:Backend 1}{code:200,data:Backend 3}{code:200,data:Backend 1}