Step‑by‑Step Guide to Building a Linux LVS NAT Load Balancer

Table of Contents

1. NAT Architecture Diagram

2. Environment Preparation

2.1 Host Planning

2.2 Linux route server configuration

2.2.1 Configure WAN IP address

2.2.2 Configure LAN IP address (rs same subnet)

2.2.3 Enable IP forwarding

2.3 Linux LVS server configuration

2.3.1 Configure LAN IP address

2.3.2 Add VIP (ens36:1)

2.3.3 Enable IP forwarding

2.4 rs‑01 server IP configuration

2.5 rs‑02 server IP configuration

2.6 Install httpd on rs‑01 and rs‑02

3. Configure LVS NAT

4. Client test – gateway method

5. Client test – direct router IP method

6. Persist ipvsadm configuration rules

NAT Architecture Diagram

2.1 Host Planning

route   LAN:192.168.87.132  WAN:192.168.10.12</code>
<code>lvs     LAN:192.168.87.131</code>
<code>rs-01   LAN:192.168.87.129</code>
<code>rs-02   LAN:192.168.87.130</code>
<code>client  WAN:192.168.10.4

2.2 Linux route server configuration

2.2.1 Configure WAN IP address

# cat /etc/sysconfig/network-scripts/ifcfg-ens33</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.10.12</code>
<code>PREFIX=24</code>
<code>GATEWAY=192.168.10.2   # default gateway</code>
<code>DNS1=192.168.10.2

2.2.2 Configure LAN IP address (rs same subnet)

# cat /etc/sysconfig/network-scripts/ifcfg-ens36</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.87.132</code>
<code>PREFIX=24</code>
<code>GATEWAY=192.168.87.2

2.2.3 Enable IP forwarding

echo "net.ipv4.ip_forward = 1" >>/etc/sysctl.conf</code>
<code>sysctl -p

2.3 Linux LVS server configuration

2.3.1 Configure LAN IP address

# cat /etc/sysconfig/network-scripts/ifcfg-ens36</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.87.131</code>
<code>PREFIX=24</code>
<code>GATEWAY=192.168.87.132   # router IP

2.3.2 Add VIP (ens36:1)

cp /etc/sysconfig/network-scripts/ifcfg-ens36 /etc/sysconfig/network-scripts/ifcfg-ens36:1</code>
<code># vi /etc/sysconfig/network-scripts/ifcfg-ens36:1</code>
<code>BOOTPROTO=static</code>
<code>NAME=ens36:1</code>
<code>DEVICE=ens36:1</code>
<code>ONBOOT=yes</code>
<code>IPADDR=192.168.87.200</code>
<code>PREFIX=24

2.3.3 Enable IP forwarding

echo "net.ipv4.ip_forward = 1" >>/etc/sysctl.conf</code>
<code>sysctl -p

2.4 rs-01 server IP configuration

2.4.1 IP address

# cat /etc/sysconfig/network-scripts/ifcfg-ens33</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.87.129</code>
<code>NETMASK=255.255.255.0</code>
<code>GATEWAY=192.168.87.131   # points to LVS LAN IP

2.4.2 Add host route (production environment may skip)

route add -host 192.168.87.132 gw 192.168.87.200</code>
<code># NAT uses the same subnet; without this route outbound traffic cannot find the router.</code>
<code># 192.168.87.132 – router IP</code>
<code># 192.168.87.200 – VIP</code>
<code>route add -host client_ip gw route_ip

2.5 rs-02 server IP configuration

2.5.1 IP address

# cat /etc/sysconfig/network-scripts/ifcfg-ens33</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.87.130</code>
<code>PREFIX=24</code>
<code>GATEWAY=192.168.87.131   # points to LVS LAN IP

2.5.2 Add host route (production environment may skip)

route add -host 192.168.87.132 gw 192.168.87.200</code>
<code># Same note as for rs‑01.</code>
<code>route add -host client_ip gw route_ip

2.6 Install httpd on rs‑01 and rs‑02

2.6.1 Install httpd

yum install httpd -y

2.6.2 Write a simple index page

# on rs‑01</code>
<code>echo "rs-01" >/var/www/html/index.html</code>
<code># on rs‑02</code>
<code>echo "rs-02" >/var/www/html/index.html

2.6.3 Start httpd service

systemctl start httpd

2.6.4 Test access

# from client</code>
<code>curl 192.168.87.129   # returns rs-01</code>
<code>curl 192.168.87.130   # returns rs-02

3. Configure LVS NAT

3.1 Create LVS cluster

ipvsadm -A -t 192.168.87.200:80 -s rr

3.2 Add real servers to the cluster

ipvsadm -a -t 192.168.87.200:80 -r 192.168.87.129:80 -m</code>
<code>ipvsadm -a -t 192.168.87.200:80 -r 192.168.87.130:80 -m

3.3 View cluster status

ipvsadm -L -n</code>
<code>IP Virtual Server version 1.2.1 (size=4096)</code>
<code>Prot LocalAddress:Port Scheduler Flags</code>
<code> -> RemoteAddress:Port Forward Weight ActiveConn InActConn</code>
<code>TCP  192.168.87.200:80 rr</code>
<code> -> 192.168.87.129:80 Masq 1 0 0</code>
<code> -> 192.168.87.130:80 Masq 1 0 0

4. Client Test – Gateway Method

4.1 Change client gateway to router IP

# vi /etc/sysconfig/network-scripts/ifcfg-ens33</code>
<code>IPADDR=192.168.10.4</code>
<code>PREFIX=24</code>
<code>GATEWAY=192.168.10.12</code>
<code>DNS1=192.168.10.2</code>
<code>systemctl restart network

4.2 Access the VIP

curl 192.168.87.200:80   # returns rs-02 or rs-01 (round‑robin)

5. Client Test – Direct Router IP Method

5.1 Remove client gateway

5.1.1 Delete GATEWAY entry

# vi /etc/sysconfig/network-scripts/ifcfg-ens33</code>
<code>BOOTPROTO=static</code>
<code>IPADDR=192.168.10.4</code>
<code>PREFIX=24</code>
<code>DNS1=192.168.10.2</code>
<code># No GATEWAY line

5.1.2 Restart network and test

systemctl restart network</code>
<code>curl 192.168.87.200:80</code>
<code># Connection fails (network unreachable) because no route to the VIP.

5.2 Configure DNAT and SNAT on the router

5.2.1 DNAT (incoming)

# Forward traffic arriving at router 192.168.10.12 to VIP 192.168.87.200</code>
<code>iptables -t nat -A PREROUTING -d 192.168.10.12 -j DNAT --to 192.168.87.200</code>
<code># Forward port 80 as well</code>
<code>iptables -t nat -A PREROUTING -d 192.168.10.12 -p tcp --dport 80 -j DNAT --to 192.168.87.200:80

5.2.2 SNAT (outgoing)

# Translate source 192.168.10.0/24 to router address for outbound traffic</code>
<code>iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to 192.168.10.12

5.3 Test access via router IP

curl 192.168.10.12   # returns rs-01</code>
<code>curl 192.168.10.12   # returns rs-02

6. Persist ipvsadm Configuration Rules

6.1 Save rules

ipvsadm-save > /etc/sysconfig/ipvsadm

6.2 Load or stop rules with systemd

systemctl start ipvsadm</code>
<code>systemctl stop ipvsadm