Introduction
Many organizations are using an external load balancer to load balance internet traffic to the virtual machines, rather than depend on built-in application load balancing. Using an external load balancer is considered more reliable than using an application's load balancer.
This page describes how to configure an SSL-passthrough load balancer using NGINX.
Solution
Prerequisites
Before you start, ensure the following:
| n | CentOS 7 is installed on the Virtual Machine. |
| n | A unique hostname and IP address are set for the Virtual Machine. |
IMPORTANT!
The IP address set must be static.
Procedure
To set and configure an external load balancer, follow these steps:
| 1. | SSH to the VM. |
| 2. | Install epel-release, using the following command: |
sudo yum install epel-release
| 3. | Install NGINX, using the following command: |
sudo yum install nginx
| 4. | Enable NGINX, using the following command: |
sudo systemctl enable nginx
| 5. | Start NGINX, using the following command: |
sudo systemctl start nginx
| 6. | Verify NGINX is running, using the following command: |
systemctl status nginx
| 7. | Disable the built-in firewall, using the following commands: |
systemctl stop firewalld
systemctl disable firewalld
| 8. | In the nginx.conf file, add an include statement to the passthrough.conf file, using the following commands: |
vi /etc/nginx/nginx.conf
Add the following code at the end of the file:
include /etc/nginx/passthrough.conf;
Note
The passthrough.conf file will be created in the following Step.
For an example of an NGINX.config, see NGINX_File_Example.
| 9. | To create and edit the passthrough.conf file, and add node details to your cluster, follow these steps: |
| a. | Navigate to /etc/nginx. |
| b. | To create and edit the passthrough.conf file, use the following command: |
vi /etc/nginx/passthrough.conf
| c. | Paste the following code and edit details relevant to your environment: |
| i. | Change the upstream name of your cluster. In this example votirosfgva is used. |
| ii. | Change the IPs to the actual node IPs. |
| iii. | Change the proxy_pass to the cluster hostname (line 19). In this example votirosfgva is used. |
## tcp LB and SSL passthrough for backend ##
stream {
upstream votirosfgva {
server 10.130.1.30:30443 max_fails=3 fail_timeout=10s;
server 10.130.1.31:30443 max_fails=3 fail_timeout=10s;
server 10.130.1.32:30443 max_fails=3 fail_timeout=10s;
}
log_format basic '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
access_log /var/log/nginx/votirosfgva_access.log basic;
error_log /var/log/nginx/votirosfgva_error.log;
server {
listen 443;
proxy_pass votirosfgva;
proxy_next_upstream on;
}
}| 10. | Verify that your syntax has no errors, using the following command: |
nginx -t
You should see the following output:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
| 11. | Reload NGINX configurations, using the following command: |
systemctl reload nginx
| 12. | Add the cluster FQDN to the host file (on a real environment it is not mandatory as they use an actual DNS server), using the following command: |
vi /etc/hosts
Add the cluster FQDN and NGINX server IP:
10.130.1.34 <cluster name>
| 13. | To pass the traffic to the nodes over 30443, follow these steps: |
| a. | Download and install audit2allow: |
sudo yum install setroubleshoot
| b. | Enable it: |
cat /var/log/audit/audit.log | grep nginx | grep denied | audit2allow -M mynginx
| c. | Execute the policy |
semodule -i mynginx.pp
| 14. | Verify that you are able to reach the nodes, using the following command: |
curl https://10.130.1.30:30443 --insecure -vv
Next Steps
To connect the Paralus cluster to this external load balancer, see the following guide: How to Check that the External Load Balancer is Working with the Votiro Cloud Cluster.
NGINX File Example
The following code is an example of an NGINX File.
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
#listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
# Settings for a TLS enabled server.
#
# server {
# listen 443 ssl http2 default_server;
# listen [::]:443 ssl http2 default_server;
# server_name _;
# root /usr/share/nginx/html;
#
# ssl_certificate "/etc/pki/nginx/server.crt";
# ssl_certificate_key "/etc/pki/nginx/private/server.key";
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 10m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
#
# # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
#
# location / {
# }
#
# error_page 404 /404.html;
# location = /40x.html {
# }
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
# }
}
include /etc/nginx/passthrough.conf;
Comments
0 comments
Please sign in to leave a comment.