1. 概述

• 內部Nginx服務器做服務網關，代理后端應用服務，卸載ssl域名證書，將接收的https請求，轉發至后端http服務。
• 華為防火墻負責NAT，啟用服務器負載均衡功能，將公網虛擬IP+端口映射到內部多臺Nginx服務器上，并對Nginx服務器進行健康檢查。
• 因為外網帶寬流量、負載都很低，所以直接使用華為防火墻做負載均衡。如果是外網帶寬流量大或負載高，建議采用獨立負載均衡方案（硬件或LVS）。

2. 架構圖

3. 配置Nginx

3.1 安裝Nginx

略

3.2 配置Nginx

1. 主配置文件

vim /usr/local/nginx/conf/nginx.conf:

user  username;worker_processes  auto;
worker_cpu_affinity auto;worker_rlimit_nofile 65535;error_log  /var/log/nginx/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;pid        /var/run/nginx/nginx.pid;events {use epoll;worker_connections  10240;
}http {server_tokens off;include       mime.types;default_type  application/octet-stream;log_format main   '{"@timestamp":"$time_iso8601",''"@msec":"$msec",''"@source":"$server_addr",''"hostname":"$hostname",''"ip":"$http_x_forwarded_for",''"client":"$remote_addr",''"request_method":"$request_method",''"scheme":"$scheme",''"domain":"$server_name",''"referer":"$http_referer",''"request":"$request_uri",''"args":"$args",''"request_body":"$request_body",''"size":$body_bytes_sent,''"status": $status,''"responsetime":$request_time,''"upstreamtime":"$upstream_response_time",''"upstreamaddr":"$upstream_addr",''"http_user_agent":"$http_user_agent",''"https":"$https",'#'"http_cookie: $http_cookie",'#'"cookie_login_token: $cookie_login_token",''}';access_log  /var/log/nginx/access.log  main;map $http_upgrade $connection_upgrade {default upgrade;''   close;}server_names_hash_bucket_size 256;client_header_buffer_size 32k;large_client_header_buffers 4 64k;client_max_body_size 1g;sendfile        on;tcp_nopush     on;#keepalive_timeout  0;keepalive_timeout  65;#gzip  on;fastcgi_connect_timeout 300;fastcgi_send_timeout 300;fastcgi_read_timeout 300;fastcgi_buffer_size 64k;fastcgi_buffers 8 64k;fastcgi_busy_buffers_size 128k;fastcgi_temp_file_write_size 128k;gzip on;gzip_min_length 1k;gzip_buffers 32 8k;gzip_http_version 1.0;gzip_comp_level 2;gzip_types text/plain application/x-javascript text/css application/xml;gzip_vary on;    # 管理虛擬主機。維護單個服務時可以注釋掉，然后重新加載配置文件禁用服務！include /usr/local/nginx/conf/conf.d/default_server.conf;                 # 8080 8443include /usr/local/nginx/conf/conf.d/proxy_yourdomain.conf;               # 8080 8443}

2. 配置默認nginx服務站點

• 禁止沒有域名的請求訪問，return 444 不返回錯誤信息。

vim /usr/local/nginx/conf/conf.d/default_server.conf

# HTTP SERVER
server {listen       8080 default_server;listen       [::]:80 default_server;server_name  _;return 444; 
}# HTTPS SERVER
server {listen       8443 ssl default_server;listen       [::]:443 ssl default_server;server_name  _;ssl_certificate "/usr/local/nginx/conf/xunku-org/xunku.org.pem";ssl_certificate_key "/usr/local/nginx/conf/xunku-org/xunku.org.key";#ssl_session_cache shared:SSL:1m;ssl_session_timeout  10m;ssl_protocols TLSv1.2 TLSv1.3;return 444;
}

3. 配置自定義代理服務站點

vim /usr/local/nginx/conf/conf.d/proxy_yourdomain.conf

# 定義upstream  
upstream  proxy_yourdomain.com {# server指令指定后端服務器的IP地址和端口server    192.168.5.76:18080;}# HTTP Server
server {# 監聽端口listen       8080;server_name  www.yourdomain.com;return 301 https://$host$request_uri;}# HTTPS Server
server { # 監聽端口listen       8443 ssl;server_name  www.yourdomain.com;ssl_certificate      /usr/local/nginx/conf/yourdomain/www.yourdomain.com.crt;ssl_certificate_key  /usr/local/nginx/conf/yourdomain/www.yourdomain.com.key;ssl_session_cache    shared:SSL:30m;ssl_session_timeout 5m;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!3DES;ssl_protocols TLSv1.2 TLSv1.3;ssl_prefer_server_ciphers  on;add_header Cache-Control no-cache;location / {# 代理轉發，服務轉發proxy_pass http://proxy_yourdomain.com;client_max_body_size 1000m;proxy_set_header Host $host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto $scheme;proxy_set_header Upgrade $http_upgrade;proxy_http_version 1.1;proxy_connect_timeout 300;proxy_read_timeout 300;proxy_send_timeout 300;#proxy_set_header Host $host:$server_port;}}

3.3 同步配置

1. 登錄192.168.5.154操作

[root@centos7-192-168-005-154 conf]# cd /usr/local/nginx/conf/
[root@centos7-192-168-005-154 conf]# pwd
/usr/local/nginx/conf

2. 修改配置（略）

3. 同步修改配置
禁止在每臺服務器上修改單獨修改

rsync -avz nginx.conf conf.d 192.168.5.120:/usr/local/nginx/conf/
rsync -avz nginx.conf conf.d 172.26.111.1:/usr/local/nginx/conf/
rsync -avz nginx.conf conf.d 172.26.112.2:/usr/local/nginx/conf/

4. 驗證配置

# username 是nginx運行的普通賬戶
sudo -u username /usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

5. 加載配置

systemctl reload nginx

4. 配置負載均衡

4.1 配置負載均衡安全策略

參見 華為官方配置文檔

4.2 配置實服務器組

配置實服務器組，其中192.168.5.154配置了，但未啟用。

4.3 配置虛擬服務