{"id":74655,"date":"2020-03-19T08:42:34","date_gmt":"2020-03-19T05:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh"},"modified":"2020-03-19T08:42:34","modified_gmt":"2020-03-19T05:42:34","slug":"kogda-linux-conntrack-vam-bolshe-ne-tovarishh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","title":{"rendered":"Kdy\u017e v\u00e1m Linux conntrack p\u0159estane b\u00fdt p\u0159\u00edtelem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Kdy\u017e v\u00e1m Linux conntrack p\u0159estane b\u00fdt p\u0159\u00edtelem\" src=\"\/wp-content\/uploads\/2020\/03\/588a169e5cfe0714694b8d7ff03985d1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Sledov\u00e1n\u00ed p\u0159ipojen\u00ed (\u201econntrack\u201c) je z\u00e1kladn\u00ed funkc\u00ed s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku j\u00e1dra Linux. Umo\u017e\u0148uje j\u00e1dru sledovat v\u0161echny logick\u00e9 s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed nebo toky a t\u00edm identifikovat v\u0161echny pakety, kter\u00e9 tvo\u0159\u00ed ka\u017ed\u00fd tok, aby je bylo mo\u017en\u00e9 zpracov\u00e1vat postupn\u011b spole\u010dn\u011b.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Conntrack je d\u016fle\u017eit\u00e1 funkce j\u00e1dra, kter\u00e1 se pou\u017e\u00edv\u00e1 v n\u011bkter\u00fdch hlavn\u00edch p\u0159\u00edpadech:<\/p>\n<p><\/p>\n<ul>\n<li>NAT se spol\u00e9h\u00e1 na informace od conntrack, tak\u017ee m\u016f\u017ee stejn\u011b zpracov\u00e1vat v\u0161echny pakety z jednoho toku. Nap\u0159\u00edklad kdy\u017e pod \u017e\u00e1d\u00e1 o slu\u017ebu Kubernetes, vyva\u017eova\u010d zat\u00ed\u017een\u00ed kube-proxy pou\u017e\u00edv\u00e1 NAT pro sm\u011brov\u00e1n\u00ed provozu na konkr\u00e9tn\u00ed pod uvnit\u0159 klastru. Conntrack zaznamen\u00e1v\u00e1, \u017ee pro ur\u010dit\u00e9 p\u0159ipojen\u00ed mus\u00ed b\u00fdt v\u0161echny pakety do IP slu\u017eby odes\u00edl\u00e1ny do stejn\u00e9ho pod, a \u017ee pakety vr\u00e1cen\u00e9 backendov\u00fdm podem mus\u00ed b\u00fdt NAT sm\u011brov\u00e1ny zp\u011bt do podu, ze kter\u00e9ho p\u0159i\u0161el po\u017eadavek.<\/li>\n<li>Firewall s sledov\u00e1n\u00edm stavu, jako je Calico, se spol\u00e9h\u00e1 na informace od conntrack, aby mohl p\u0159id\u00e1vat \u201eodpov\u00eddaj\u00edc\u00ed\u201c provoz do whitelistu. To v\u00e1m umo\u017e\u0148uje napsat s\u00ed\u0165ovou politiku, kter\u00e1 \u0159\u00edk\u00e1: \u201eumo\u017enit m\u00e9mu podu p\u0159ipojit se k jak\u00e9koli vzd\u00e1len\u00e9 IP adrese\u201c bez nutnosti ps\u00e1t politiku pro explicitn\u00ed povolen\u00ed odpov\u00eddaj\u00edc\u00edho provozu. (Bez toho byste museli p\u0159idat mnohem m\u00e9n\u011b bezpe\u010dn\u00e9 pravidlo \u201epovolit pakety do m\u00e9ho podu z jak\u00e9koli IP\u201c.)<\/li>\n<\/ul>\n<p><\/p>\n<p>Krom\u011b toho conntrack obvykle zvy\u0161uje v\u00fdkon syst\u00e9mu (sni\u017euje spot\u0159ebu procesorov\u00e9ho \u010dasu a latenci paket\u016f), proto\u017ee pouze prvn\u00ed paket v toku<br \/>\nmus\u00ed proj\u00edt \u00fapln\u00fdm zpracov\u00e1n\u00edm s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku, aby se zjistilo, co s n\u00edm d\u011blat. Pod\u00edvejte se na p\u0159\u00edsp\u011bvek \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/blog\/comparing-kube-proxy-modes-iptables-or-ipvs\/\">Porovn\u00e1n\u00ed re\u017eim\u016f kube-proxy<\/a><\/noindex>\u201c, abyste vid\u011bli p\u0159\u00edklad toho, jak to funguje.<\/p>\n<p><\/p>\n<p>P\u0159esto m\u00e1 conntrack sv\u00e1 omezen\u00ed\u2026<\/p>\n<p><\/p>\n<h3 id=\"itak-gde-vse-poshlo-ne-tak\">Tak\u017ee, kde se to v\u0161echno pokazilo?<\/h3>\n<p><\/p>\n<p>Tabulka conntrack m\u00e1 nastaviteln\u00e9 maxim\u00e1ln\u00ed velikosti a pokud se napln\u00ed, p\u0159ipojen\u00ed obvykle za\u010dnou b\u00fdt odm\u00edt\u00e1na nebo p\u0159eru\u0161ena. Pro zpracov\u00e1n\u00ed provozu v\u011bt\u0161iny aplikac\u00ed je v tabulce obvykle dostatek voln\u00e9ho m\u00edsta a nikdy to nep\u0159eroste v probl\u00e9m. Nicm\u00e9n\u011b existuje n\u011bkolik sc\u00e9n\u00e1\u0159\u016f, ve kter\u00fdch byste m\u011bli zv\u00e1\u017eit pou\u017eit\u00ed tabulky conntrack:<\/p>\n<p><\/p>\n<ul>\n<li>Nejd\u016fle\u017eit\u011bj\u0161\u00ed p\u0159\u00edpad nast\u00e1v\u00e1, kdy\u017e v\u00e1\u0161 server zpracov\u00e1v\u00e1 mimo\u0159\u00e1dn\u011b velk\u00e9 mno\u017estv\u00ed sou\u010dasn\u011b aktivn\u00edch p\u0159ipojen\u00ed. Nap\u0159\u00edklad pokud je va\u0161e tabulka conntrack nastavena na 128k z\u00e1znam\u016f, ale m\u00e1te v\u00edce ne\u017e 128k sou\u010dasn\u00fdch p\u0159ipojen\u00ed, ur\u010dit\u011b naraz\u00edte na probl\u00e9m!<\/li>\n<li>O n\u011bco m\u00e9n\u011b z\u0159ejm\u00fd p\u0159\u00edpad: pokud v\u00e1\u0161 server zpracov\u00e1v\u00e1 velmi velk\u00e9 mno\u017estv\u00ed p\u0159ipojen\u00ed za sekundu. I kdy\u017e jsou p\u0159ipojen\u00ed kr\u00e1tkodob\u00e1, Linux je sleduje po ur\u010ditou dobu (v\u00fdchoz\u00ed nastaven\u00ed je 120 s). Nap\u0159\u00edklad pokud je va\u0161e tabulka conntrack nastavena na 128 tis\u00edc z\u00e1znam\u016f a pokou\u0161\u00edte se zpracovat 1100 p\u0159ipojen\u00ed za sekundu, p\u0159ekro\u010d\u00ed to velikost tabulky conntrack, i kdy\u017e jsou p\u0159ipojen\u00ed velmi kr\u00e1tk\u00e1 (128k \/ 120 s = 1092 p\u0159ipojen\u00ed\/s).<\/li>\n<\/ul>\n<p><\/p>\n<p>Existuje n\u011bkolik specifick\u00fdch typ\u016f aplikac\u00ed, kter\u00e9 spadaj\u00ed do t\u011bchto kategori\u00ed. D\u00e1le, pokud m\u00e1te hodn\u011b nep\u0159\u00e1tel, m\u016f\u017ee b\u00fdt zapln\u011bn\u00ed tabulky conntrack va\u0161eho serveru mnoha polootev\u0159en\u00fdmi p\u0159ipojen\u00edmi vyu\u017eito v r\u00e1mci \u00fatoku typu \u201eodm\u00edtnut\u00ed slu\u017eby\u201c (DOS). V obou p\u0159\u00edpadech se conntrack m\u016f\u017ee st\u00e1t limituj\u00edc\u00edm \u00fazk\u00fdm m\u00edstem ve va\u0161\u00ed syst\u00e9mu. V n\u011bkter\u00fdch p\u0159\u00edpadech m\u016f\u017ee b\u00fdt \u00faprava parametr\u016f tabulky conntrack dosta\u010duj\u00edc\u00ed pro spln\u011bn\u00ed va\u0161ich pot\u0159eb \u2014 zv\u00fd\u0161en\u00edm velikosti nebo zkr\u00e1cen\u00edm \u010dasov\u00fdch limit\u016f conntrack (ale pokud to ud\u011bl\u00e1te \u0161patn\u011b, budete \u010delit velk\u00fdm pot\u00ed\u017e\u00edm). V jin\u00fdch p\u0159\u00edpadech bude t\u0159eba obej\u00edt conntrack pro agresivn\u00ed provoz.<\/p>\n<p><\/p>\n<h4 id=\"realnyy-primer\">Skute\u010dn\u00fd p\u0159\u00edklad<\/h4>\n<p><\/p>\n<p>Uve\u010fme konkr\u00e9tn\u00ed p\u0159\u00edklad: jeden velk\u00fd poskytovatel SaaS, se kter\u00fdm jsme spolupracovali, m\u011bl \u0159adu memcached server\u016f na hostitel\u00edch (ne virtu\u00e1ln\u00edch stroj\u00edch), z nich\u017e ka\u017ed\u00fd zpracov\u00e1val v\u00edce ne\u017e 50K kr\u00e1tkodob\u00fdch p\u0159ipojen\u00ed za sekundu.<\/p>\n<p><\/p>\n<p>Zkou\u0161eli experimentovat s konfigurac\u00ed conntrack, zvy\u0161ovali velikosti tabulek a zkracovali \u010das sledov\u00e1n\u00ed, ale konfigurace byla nespolehliv\u00e1, v\u00fdrazn\u011b vzrostla spot\u0159eba RAM, co\u017e bylo probl\u00e9mem (kter\u00e9 bylo na \u00farovni gigabajt\u016f!), a p\u0159ipojen\u00ed byla tak kr\u00e1tk\u00e1, \u017ee conntrack nedosahoval obvykl\u00fdch p\u0159\u00ednos\u016f v v\u00fdkonu (sn\u00ed\u017een\u00ed spot\u0159eby CPU nebo latence paket\u016f).<\/p>\n<p><\/p>\n<p>Jako alternativu se obr\u00e1tili na Calico. S\u00ed\u0165ov\u00e9 politiky Calico umo\u017e\u0148uj\u00ed nevyu\u017e\u00edvat conntrack pro ur\u010dit\u00fd typ provozu (pou\u017eit\u00edm mo\u017enosti doNotTrack pro politiky). To jim zajistilo pot\u0159ebnou \u00farove\u0148 v\u00fdkonu a nav\u00edc dal\u0161\u00ed \u00farove\u0148 zabezpe\u010den\u00ed poskytovanou Calico.<\/p>\n<p><\/p>\n<h4 id=\"na-chto-pridetsya-poyti-chtoby-oboyti-conntrack\">Co v\u0161e budete muset ud\u011blat, abyste obch\u00e1zeli conntrack?<\/h4>\n<p><\/p>\n<ul>\n<li>Politiky do-not-track by m\u011bly b\u00fdt obvykle symetrick\u00e9. V p\u0159\u00edpad\u011b poskytovatele SaaS: jejich aplikace pracovaly uvnit\u0159 chr\u00e1n\u011bn\u00e9 z\u00f3ny, a proto pomoc\u00ed s\u00ed\u0165ov\u00e9 politiky mohli p\u0159idat do whitelistu provoz z jin\u00fdch konkr\u00e9tn\u00edch aplikac\u00ed, kter\u00fdm byl povolen p\u0159\u00edstup k memcached.<\/li>\n<li>Politika do-not-track nezohled\u0148uje sm\u011br spojen\u00ed. Tak\u017ee, v p\u0159\u00edpad\u011b hacku memcached serveru, by se teoreticky dalo pokusit p\u0159ipojit k jak\u00e9mukoli z memcached klient\u016f, pokud pou\u017e\u00edv\u00e1 spr\u00e1vn\u00fd v\u00fdchoz\u00ed port. Nicm\u00e9n\u011b, pokud jste spr\u00e1vn\u011b definovali s\u00ed\u0165ovou politiku pro sv\u00e9 klienty memcached, tyto pokusy o p\u0159ipojen\u00ed budou i tak odm\u00edtnuty na stran\u011b klienta.<\/li>\n<li>Politika do-not-track se aplikuje na ka\u017ed\u00fd paket, na rozd\u00edl od b\u011b\u017en\u00fdch politik, kter\u00e9 se aplikuj\u00ed pouze na prvn\u00ed paket z toku. To m\u016f\u017ee zv\u00fd\u0161it spot\u0159ebu CPU na jeden paket, proto\u017ee pro ka\u017ed\u00fd paket je t\u0159eba aplikovat politiku. Ale pro kr\u00e1tkodob\u00e1 spojen\u00ed se tato spot\u0159eba vyrovn\u00e1v\u00e1 se sn\u00ed\u017een\u00edm spot\u0159eby prost\u0159edk\u016f na zpracov\u00e1n\u00ed conntrack. Nap\u0159\u00edklad v p\u0159\u00edpad\u011b poskytovatele SaaS bylo po\u010det paket\u016f pro ka\u017ed\u00e9 spojen\u00ed velmi mal\u00e9, tak\u017ee dodate\u010dn\u00e1 spot\u0159eba CPU p\u0159i aplikaci politik na ka\u017ed\u00fd paket byla od\u016fvodn\u011bn\u00e1.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"pristupim-k-testam\">P\u0159ejdeme k testov\u00e1n\u00ed<\/h4>\n<p><\/p>\n<p>Provedli jsme test na jednom podu s memcached serverem a mnoha podech klient\u016f memcached spu\u0161t\u011bn\u00fdch na vzd\u00e1len\u00fdch uzlech, abychom mohli zpracov\u00e1vat velmi vysok\u00fd po\u010det spojen\u00ed za sekundu. Server s podm memcached serveru m\u011bl 8 jader a 512k z\u00e1znam\u016f v tabulce conntrack (standardn\u00ed velikost tabulky nastaven\u00e1 pro hostitele).<br \/>\nM\u011b\u0159ili jsme rozd\u00edl ve v\u00fdkonu mezi: bez s\u00ed\u0165ov\u00e9 politiky; s b\u011b\u017enou Calico politikou; a s Calico do-not-track politikou.<\/p>\n<p><\/p>\n<p>Pro prvn\u00ed test jsme nastavili po\u010det p\u0159ipojen\u00ed na 4 000 za sekundu, tak\u017ee jsme se mohli zam\u011b\u0159it na rozd\u00edly v CPU. Mezi absenc\u00ed politiky a b\u011b\u017enou politikou nebyly v\u00fdznamn\u00e9 rozd\u00edly, ale politika do-not-track zv\u00fd\u0161ila spot\u0159ebu CPU p\u0159ibli\u017en\u011b o 20 %:<\/p>\n<p>\n<img decoding=\"async\" alt=\"Kdy\u017e v\u00e1m Linux conntrack p\u0159estane b\u00fdt p\u0159\u00edtelem\" src=\"\/wp-content\/uploads\/2020\/03\/6762772cb8e5f089a3ed444aff8cb8f4.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Ve druh\u00e9m testu jsme spustili tolik p\u0159ipojen\u00ed, kolik na\u0161i klienti mohli generovat, a m\u011b\u0159ili maxim\u00e1ln\u00ed po\u010det p\u0159ipojen\u00ed za sekundu, kter\u00fd n\u00e1\u0161 server memcached zvl\u00e1dnul. Jak se o\u010dek\u00e1valo, v p\u0159\u00edpad\u011b \u201ebez politik\u201c a \u201eb\u011b\u017en\u00e1 politika\u201c ob\u011b dos\u00e1hly limitu conntrack nad 4 000 p\u0159ipojen\u00ed za sekundu (512k \/ 120s = 4 369 p\u0159ipojen\u00ed\/s). S politikou do-not-track na\u0161i klienti odes\u00edlali 60 000 p\u0159ipojen\u00ed za sekundu bez jak\u00fdchkoli probl\u00e9m\u016f. Jsme si jisti, \u017ee bychom toto \u010d\u00edslo mohli zv\u00fd\u0161it p\u0159ipojen\u00edm v\u00edce klient\u016f, ale c\u00edt\u00edme, \u017ee tato \u010d\u00edsla jsou ji\u017e dostate\u010dn\u00e1 k ilustraci poselstv\u00ed tohoto \u010dl\u00e1nku!<\/p>\n<p>\n<img decoding=\"async\" alt=\"Kdy\u017e v\u00e1m Linux conntrack p\u0159estane b\u00fdt p\u0159\u00edtelem\" src=\"\/wp-content\/uploads\/2020\/03\/f3beeb1793a3158018274079da953a2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h4 id=\"zaklyuchenie\">Z\u00e1v\u011br<\/h4>\n<p><\/p>\n<p>Conntrack je d\u016fle\u017eit\u00e1 funkce j\u00e1dra. V\u00fdborn\u011b pln\u00ed svou pr\u00e1ci. \u010casto je vyu\u017e\u00edv\u00e1n kl\u00ed\u010dov\u00fdmi komponentami syst\u00e9mu. V n\u011bkter\u00fdch specifick\u00fdch sc\u00e9n\u00e1\u0159\u00edch v\u0161ak zat\u00ed\u017een\u00ed kv\u016fli conntracku p\u0159evy\u0161uje b\u011b\u017en\u00e9 v\u00fdhody, kter\u00e9 p\u0159in\u00e1\u0161\u00ed. V tomto sc\u00e9n\u00e1\u0159i mohou b\u00fdt s\u00ed\u0165ov\u00e9 politiky Calico pou\u017eity k selektivn\u00edmu zak\u00e1z\u00e1n\u00ed pou\u017e\u00edv\u00e1n\u00ed conntracku, \u010d\u00edm\u017e se zvy\u0161uje \u00farove\u0148 s\u00ed\u0165ov\u00e9 bezpe\u010dnosti. Pro ve\u0161ker\u00fd ostatn\u00ed provoz z\u016fst\u00e1v\u00e1 conntrack va\u0161\u00edm spojencem!<\/p>\n<p><\/p>\n<h2 id=\"takzhe-chitayte-drugie-stati-v-nashem-bloge\">Tak\u00e9 si p\u0159e\u010dt\u011bte dal\u0161\u00ed \u010dl\u00e1nky na na\u0161em blogu:<\/h2>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473578\/\">Sestaven\u00ed dynamick\u00fdch modul\u016f pro Nginx<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473014\/\">\u00davod do autorizace Kubernetes v Hashicorp Consul<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/426543\/\">Z\u00e1lohy Stateful v Kubernetes<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/424717\/\">Z\u00e1lohov\u00e1n\u00ed velk\u00e9ho mno\u017estv\u00ed r\u016fznorod\u00fdch webov\u00fdch projekt\u016f<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/347526\/\">Telegram bot pro Redmine. Jak si usnadnit \u017eivot sob\u011b i lidem<\/a><\/noindex><\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/492686\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kdy v\u00e1m ji\u017e Linux conntrack nen\u00ed spojencem | ProHoster","description":"Sledov\u00e1n\u00ed p\u0159ipojen\u00ed (\u201econntrack\u201c) je.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster","og:description":"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-19T05:42:34+00:00","article:modified_time":"2020-03-19T05:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:10:25","updated":"2022-10-05 19:52:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=74655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/74656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=74655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=74655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=74655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}