Nginx 反向代理与负载均衡高级配置 2026 | 高性能高可用架构实战

Nginx 作为最流行的反向代理和负载均衡器，其高级功能远不止基础的请求转发。本文将深入 Nginx 负载均衡的核心特性，从负载均衡算法到健康检查，从会话保持到限流缓存，全面掌握构建高性能高可用架构的实战技能。

---

一、负载均衡基础

1.1 负载均衡架构

客户端请求
    │
    ▼
┌─────────┐
│  Nginx  │ ← 负载均衡器
└────┬────┘
     │
     ├──→ 后端服务器 1 (192.168.1.101)
     ├──→ 后端服务器 2 (192.168.1.102)
     └──→ 后端服务器 3 (192.168.1.103)

1.2 基础配置

http {
    upstream backend {
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
        server 192.168.1.103:8080;
    }

    server {
        listen 80;
        server_name example.com;

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
}

---

二、5 种负载均衡算法

2.1 轮询（Round Robin）— 默认

upstream backend {
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;
}

特点： 请求按顺序逐一分配，默认算法。

2.2 加权轮询（Weighted Round Robin）

upstream backend {
    server 192.168.1.101:8080 weight=5;  # 处理 50% 请求
    server 192.168.1.102:8080 weight=3;  # 处理 30% 请求
    server 192.168.1.103:8080 weight=2;  # 处理 20% 请求
}

特点： 根据服务器性能分配不同权重，性能好的服务器多分请求。

2.3 IP 哈希（IP Hash）

upstream backend {
    ip_hash;
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;
}

特点： 根据客户端 IP 哈希分配，同一客户端始终访问同一服务器，实现简单的会话保持。

2.4 最少连接（Least Connections）

upstream backend {
    least_conn;
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;
}

特点： 将请求分配给当前连接数最少的服务器，适合请求处理时间差异大的场景。

2.5 最少时间（Least Time）— Nginx Plus

upstream backend {
    least_time header;  # 或 least_time last_byte
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;
}

特点： 选择响应时间最短的服务器，需要 Nginx Plus 商业版。

---

三、服务器状态管理

3.1 服务器状态参数

upstream backend {
    # 正常服务器
    server 192.168.1.101:8080 weight=5 max_fails=3 fail_timeout=30s;

    # 备用服务器（正常服务器都挂了才用）
    server 192.168.1.102:8080 backup;

    # 不可用（已下线）
    server 192.168.1.103:8080 down;

    # 最大连接数
    server 192.168.1.104:8080 max_conns=100;

    # 慢启动（新加入的服务器逐渐增加流量）
    server 192.168.1.105:8080 slow_start=30s;
}

3.2 主动健康检查 — Nginx Plus

upstream backend {
    zone backend 64k;
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;
}

server {
    location / {
        proxy_pass http://backend;
        health_check interval=5s fails=3 passes=2 uri=/health match=health_ok;
    }

    match health_ok {
        status 200;
        body ~ '"status":"ok"';
    }
}

3.3 被动健康检查 — 开源版

upstream backend {
    server 192.168.1.101:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.102:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.103:8080 max_fails=3 fail_timeout=30s;
}

server {
    location / {
        proxy_pass http://backend;
        proxy_next_upstream error timeout http_500 http_502 http_503;
        proxy_connect_timeout 5s;
        proxy_read_timeout 10s;
        proxy_send_timeout 10s;
    }
}

proxy_next_upstream 参数说明：

• error：连接错误或超时
• timeout：读取/发送超时
• http_500：500 错误
• http_502：502 错误
• http_503：503 错误
• http_403：403 错误
• http_404：404 错误
• non_idempotent：非幂等请求也重试（POST 等，谨慎使用）

---

四、会话保持

4.1 Cookie 会话保持

upstream backend {
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
    server 192.168.1.103:8080;

    # 使用 cookie 实现会话粘性
    sticky cookie srv_id expires=1h domain=.example.com path=/;
}

4.2 route 方法会话保持

upstream backend {
    server 192.168.1.101:8080 route=server1;
    server 192.168.1.102:8080 route=server2;

    sticky route $route_cookie $route_uri;
}

map $cookie_jsessionid $route_cookie {
    ~.+\.(?P<route>\w+)$ $route;
}

4.3 learn 方法 — Nginx Plus

upstream backend {
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;

    sticky learn
        create=$upstream_cookie_sessionid
        lookup=$cookie_sessionid
        zone=client_sessions:1m
        timeout=1h;
}

---

五、连接限流与速率限制

5.1 请求速率限制

http {
    # 定义限流区域（按客户端 IP）
    limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;

    server {
        location /api/ {
            # 应用限流，允许突发 20 个请求（nodelay 不延迟处理）
            limit_req zone=req_limit burst=20 nodelay;
            proxy_pass http://backend;
        }

        location /login/ {
            # 登录接口更严格的限流
            limit_req zone=login_limit burst=5 nodelay;
            limit_req_status 429;
            proxy_pass http://backend;
        }
    }

    # 登录专用限流
    limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/m;
}

5.2 连接数限制

http {
    # 按 IP 限制连接数
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

    server {
        location /download/ {
            # 每个 IP 最多 10 个连接
            limit_conn conn_limit 10;
            limit_conn_status 429;
            proxy_pass http://backend;
        }
    }
}

5.3 带宽限制

server {
    location /download/ {
        # 限制每个连接的传输速率
        limit_rate 1m;       # 1MB/s
        limit_rate_after 10m; # 传输 10MB 后开始限速

        proxy_pass http://backend;
    }
}

5.4 限流日志配置

http {
    limit_req_log_level warn;
    limit_conn_log_level warn;
    limit_rate 1m;

    # 自定义错误页面
    error_page 429 /429.html;
    location = /429.html {
        root /usr/share/nginx/html;
        internal;
    }
}

---

六、缓存配置

6.1 基础缓存配置

http {
    # 定义缓存区域
    proxy_cache_path /var/cache/nginx
        levels=1:2
        keys_zone=my_cache:10m
        max_size=10g
        inactive=7d
        use_temp_path=off;

    server {
        location /static/ {
            proxy_cache my_cache;
            proxy_cache_valid 200 302 10m;
            proxy_cache_valid 404 1m;
            proxy_cache_valid any 5m;
            proxy_cache_key "$scheme$request_method$host$request_uri";
            add_header X-Cache-Status $upstream_cache_status;
            proxy_pass http://backend;
        }
    }
}

6.2 缓存精细控制

http {
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=10g;

    server {
        location /api/ {
            proxy_cache api_cache;

            # 只缓存 GET 和 HEAD 请求
            proxy_cache_methods GET HEAD;

            # 缓存响应码
            proxy_cache_valid 200 302 5m;
            proxy_cache_valid 301 1h;
            proxy_cache_valid 404 1m;

            # 使用后端的 Cache-Control 头
            proxy_cache_valid any 1m;
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503;

            # 缓存锁（防止缓存击穿）
            proxy_cache_lock on;
            proxy_cache_lock_timeout 5s;

            # 缓存键
            proxy_cache_key "$host$request_uri$cookie_user_id";

            # 添加缓存状态头
            add_header X-Cache $upstream_cache_status;

            proxy_pass http://backend;
        }
    }
}

6.3 缓存清理

# 使用 proxy_cache_purge 模块（需要编译或 Nginx Plus）
server {
    location ~ /purge(/.*) {
        allow 127.0.0.1;
        deny all;
        proxy_cache_purge my_cache $scheme$request_method$host$1;
    }
}

---

七、WebSocket 代理

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    upstream ws_backend {
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
    }

    server {
        listen 80;
        server_name ws.example.com;

        location /ws/ {
            proxy_pass http://ws_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;

            # WebSocket 超时配置
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;

            # 会话保持（WebSocket 需要）
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

---

八、gRPC 代理

http {
    upstream grpc_backend {
        server 192.168.1.101:50051;
        server 192.168.1.102:50051;
    }

    server {
        listen 443 ssl http2;
        server_name grpc.example.com;

        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

        location / {
            grpc_pass grpc://grpc_backend;

            # gRPC 超时
            grpc_read_timeout 300s;
            grpc_send_timeout 300s;

            # gRPC 响应头
            grpc_set_header X-Real-IP $remote_addr;

            # 流式 RPC 支持
            grpc_buffer_size 64k;
        }
    }
}

---

九、四层负载均衡（TCP/UDP）

# /etc/nginx/nginx.conf — 需要在 stream 块中配置
stream {
    # TCP 负载均衡
    upstream mysql_cluster {
        server 192.168.1.101:3306 weight=5;
        server 192.168.1.102:3306 weight=5;
        server 192.168.1.103:3306 backup;
    }

    upstream redis_cluster {
        server 192.168.1.101:6379;
        server 192.168.1.102:6379;
        hash $remote_addr consistent;
    }

    server {
        listen 3306;
        proxy_pass mysql_cluster;
        proxy_connect_timeout 3s;
        proxy_timeout 30s;
    }

    server {
        listen 6379;
        proxy_pass redis_cluster;
    }

    # UDP 负载均衡
    upstream dns_servers {
        server 8.8.8.8:53;
        server 8.8.4.4:53;
    }

    server {
        listen 53 udp;
        proxy_pass dns_servers;
        proxy_timeout 5s;
    }
}

http {
    # HTTP 配置...
}

---

十、生产环境最佳实践

10.1 完整生产配置示例

user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 65535;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    '$request_time $upstream_response_time';

    access_log /var/log/nginx/access.log main;

    # 基础优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    # Gzip 压缩
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss;

    # 限流配置
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

    # 缓存配置
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=static_cache:100m max_size=10g inactive=7d;

    # 上游服务器
    upstream app_backend {
        least_conn;
        server 192.168.1.101:8080 weight=5 max_fails=3 fail_timeout=30s;
        server 192.168.1.102:8080 weight=5 max_fails=3 fail_timeout=30s;
        server 192.168.1.103:8080 weight=3 max_fails=3 fail_timeout=30s backup;

        keepalive 64;
    }

    # HTTP 重定向到 HTTPS
    server {
        listen 80;
        server_name example.com www.example.com;
        return 301 https://$server_name$request_uri;
    }

    # HTTPS 主配置
    server {
        listen 443 ssl http2;
        server_name example.com www.example.com;

        # SSL 配置
        ssl_certificate /etc/nginx/ssl/example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/example.com.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # 安全头
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        # 静态文件缓存
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            proxy_cache static_cache;
            proxy_cache_valid 200 30d;
            proxy_cache_valid 404 1m;
            expires 30d;
            add_header Cache-Control "public, immutable";
            proxy_pass http://app_backend;
        }

        # API 接口
        location /api/ {
            limit_req zone=api_limit burst=200 nodelay;
            limit_conn conn_limit 50;

            proxy_pass http://app_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_connect_timeout 5s;
            proxy_read_timeout 30s;
            proxy_send_timeout 30s;

            proxy_next_upstream error timeout http_500 http_502 http_503;
            proxy_next_upstream_tries 2;
        }

        # 根路径
        location / {
            proxy_pass http://app_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }
    }
}

10.2 Nginx 状态监控

server {
    listen 8080;
    server_name localhost;

    # 基础状态页
    location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }

    # Nginx Plus 状态 API
    location /api/ {
        api write=off;
        allow 127.0.0.1;
        deny all;
    }
}

---

十一、高可用架构

11.1 Nginx 主备模式（Keepalived）

# 安装 Keepalived
apt install keepalived

# /etc/keepalived/keepalived.conf — 主节点
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass secret123
    }

    virtual_ipaddress {
        192.168.1.100
    }

    track_script {
        chk_nginx
    }
}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight -20
}

# /etc/keepalived/check_nginx.sh
#!/bin/bash
if [ "$(pidof nginx | wc -w)" -eq 0 ]; then
    exit 1
else
    exit 0
fi

---

十二、总结

• ✅ 掌握 5 种负载均衡算法（轮询、加权、IP哈希、最少连接、最少时间）
• ✅ 服务器状态管理与健康检查
• ✅ 会话保持实现（Cookie、route、learn）
• ✅ 连接限流与速率限制
• ✅ Nginx 缓存配置与管理
• ✅ WebSocket 和 gRPC 代理
• ✅ 四层负载均衡（TCP/UDP）
• ✅ 生产环境完整配置
• ✅ 高可用架构（Keepalived 主备）

Nginx 负载均衡是构建高性能高可用系统的基石，掌握这些高级配置，让你的架构更加稳定和高效。

---

相关阅读：

• Nginx 反向代理与 SSL 证书配置完整教程
• Docker Swarm 集群部署入门
• iptables 防火墙配置实战指南
• VPS 性能监控与告警系统搭建实战