Linux iSCSI Target with targetcli (LIO): Setup Guide

The Linux kernel's LIO target subsystem turns any Linux server into a SAN storage array, exporting local disks, LVM volumes or plain files to iSCSI initiators on the network. The administration shell for LIO is targetcli, a tree-based CLI with tab completion that walks you through backstores, targets, portals, LUNs and ACLs. Whether you are building a small lab SAN, a backup target for VMware ESXi, or a shared disk for a cluster, the workflow is the same. This guide follows Red Hat's documented procedure step by step and ends with the initiator-side commands that verify the whole path.

Install and Start the Target Service

# dnf install targetcli
# systemctl enable --now target

Step 1: Create a Backstore

A backstore defines how the exported LUN's data is stored. The two most common types are fileio (a regular file as a disk image) and block (a real block device such as /dev/sdb, an LVM volume or a RAID device):

# targetcli
/> backstores/fileio
/backstores/fileio> create file1 /tmp/disk1.img 200M write_back=false

/> backstores/block
/backstores/block> create name=block_backend dev=/dev/sdb

Use write_back=false for fileio unless you accept the higher data-loss risk of the file system cache. For production block storage, the block backstore over an LVM or hardware RAID device is the safer choice.

Step 2: Create the iSCSI Target and LUN

/> iscsi/
/iscsi> create iqn.2006-04.com.example:444
/iscsi> cd iqn.2006-04.com.example:444/tpg1
/iscsi/iqn.20...:444/tpg1> luns/ create /backstores/block/block_backend
/iscsi/iqn.20...:444/tpg1> luns/ create /backstores/fileio/file1

The create command auto-generates an IQN if you omit it, and every target automatically gets a target portal group (tpg1) listening on 0.0.0.0:3260.

Step 3: Create Portals (if Needed)

By default LIO listens on all addresses on the standard iSCSI port. To bind a specific IP or add high-availability portals:

/iscsi/iqn.20...:444/tpg1> portals/ create 192.168.1.10

Step 4: Allow Initiators with ACLs

Find the initiator's IQN (it lives in /etc/iscsi/initiatorname.iscsi on the client) and create an ACL so that initiator may log in. targetcli maps the LUNs to the ACL automatically:

/iscsi/iqn.20...:444/tpg1> acls/ create iqn.2005-03.org.open-iscsi:SERIAL

To export a read-only LUN to a specific initiator, disable auto-mapping first, then create the mapped LUN with write_protect=1:

/> set global auto_add_mapped_luns=false
/iscsi/iqn.20...:444/tpg1/acls/iqn.2005-03.org.open-iscsi:SERIAL> create mapped_lun=1 tpg_lun_or_backstore=/backstores/block/block2 write_protect=1

Save the Configuration and Verify

/> saveconfig
/> ls
# ss -tlnp | grep 3260

saveconfig writes /etc/target/saveconfig.json so the target survives reboots. From the initiator host, discover and log in:

# iscsiadm -m discovery -t sendtargets -p 192.168.1.10
# iscsiadm -m node -L all
# lsblk

Related articles: Linux multipath configuration for iSCSI SANs and Fibre Channel vs iSCSI vs NVMe-oF.

原文链接：https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_storage_devices/configuring-an-iscsi-target_managing-storage-devices