{"id":81265,"date":"2020-05-12T01:42:43","date_gmt":"2020-05-11T23:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux"},"modified":"2020-05-12T01:42:43","modified_gmt":"2020-05-11T23:42:43","slug":"bystryj-routing-i-nat-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","title":{"rendered":"Rychl\u00e9 sm\u011brov\u00e1n\u00ed a NAT v Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>S rostouc\u00edm nedostatkem IPv4 adres se mnoho poskytovatel\u016f internetu setkalo s nutnost\u00ed organizovat p\u0159\u00edstup sv\u00fdch klient\u016f do s\u00edt\u011b prost\u0159ednictv\u00edm p\u0159eklad\u016f adres. V tomto \u010dl\u00e1nku si pov\u00edme, jak lze dos\u00e1hnout v\u00fdkonu na \u00farovni Carrier Grade NAT na komoditn\u00edch serverech.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Trocha historie<\/h3>\n<p>\nT\u00e9ma vy\u010derp\u00e1n\u00ed adresn\u00edho prostoru IPv4 ji\u017e nen\u00ed nov\u00e9. V ur\u010dit\u00e9m okam\u017eiku se v RIPE objevily \u010dekac\u00ed seznamy, pot\u00e9 vznikly burzy, na kter\u00fdch se obchodovalo s bloky adres a uzav\u00edraly se dohody o jejich pron\u00e1jmu. Postupn\u011b za\u010dali poskytovatel\u00e9 slu\u017eeb internetu poskytovat slu\u017eby p\u0159ipojen\u00ed k internetu pomoc\u00ed p\u0159eklad\u016f adres a port\u016f. N\u011bkte\u0159\u00ed nestihli z\u00edskat dostate\u010dn\u00fd po\u010det adres, aby mohli poskytnout \u201eb\u00edlou\u201c adresu ka\u017ed\u00e9mu u\u017eivateli, zat\u00edmco jin\u00ed za\u010dali \u0161et\u0159it a odm\u00edtli n\u00e1kup adres na sekund\u00e1rn\u00edm trhu. V\u00fdrobci s\u00ed\u0165ov\u00e9ho vybaven\u00ed podpo\u0159ili tuto my\u0161lenku, proto\u017ee tato funkce obvykle vy\u017eaduje dal\u0161\u00ed roz\u0161i\u0159uj\u00edc\u00ed moduly nebo licence. Nap\u0159\u00edklad u Juniperu v \u0159ad\u011b sm\u011brova\u010d\u016f MX (krom\u011b posledn\u00edch MX104 a MX204) lze prov\u00e1d\u011bt NAPT na samostatn\u00e9 servisn\u00ed kart\u011b MS-MIC, na Cisco ASR1k je pot\u0159eba licence CGN license, a na Cisco ASR9k samostatn\u00fd modul A9K-ISM-100 a licence A9K-CGN-LIC k n\u011bmu. Celkov\u011b to nen\u00ed levn\u00e1 z\u00e1le\u017eitost.<\/p>\n<h3>IPTables<\/h3>\n<p>\n\u00daloha prov\u00e1d\u011bn\u00ed NAT nevy\u017eaduje specializovan\u00e9 v\u00fdpo\u010detn\u00ed zdroje, je schopna ji vy\u0159e\u0161it procesor pro obecn\u00e9 pou\u017eit\u00ed, kter\u00fd je nainstalov\u00e1n nap\u0159\u00edklad v jak\u00e9mkoliv dom\u00e1c\u00edm sm\u011brova\u010di. V m\u011b\u0159\u00edtku poskytovatele slu\u017eeb lze tuto \u00falohu vy\u0159e\u0161it pomoc\u00ed komoditn\u00edch server\u016f s opera\u010dn\u00edm syst\u00e9mem FreeBSD (ipfw\/pf) nebo GNU\/Linux (iptables). FreeBSD zva\u017eovat nebudeme, proto\u017ee jsem u\u017e d\u00e1vno p\u0159estal tuto opera\u010dn\u00ed soustavu pou\u017e\u00edvat, a tak se zam\u011b\u0159\u00edme na GNU\/Linux.<\/p>\n<p>Zapnut\u00ed p\u0159eklad\u016f adres nen\u00ed nijak slo\u017eit\u00e9. Nejprve je t\u0159eba vytvo\u0159it pravidlo v iptables v tabulce nat:<\/p>\n<pre><code class=\"bash\">iptables -t nat -A POSTROUTING -s 100.64.0.0\/10 -j SNAT --to - --persistent\n<\/code><\/pre>\n<p>\nOpera\u010dn\u00ed syst\u00e9m na\u010dte modul nf_conntrack, kter\u00fd bude sledovat v\u0161echna aktivn\u00ed p\u0159ipojen\u00ed a prov\u00e1d\u011bt pot\u0159ebn\u00e9 transformace. Existuje zde n\u011bkolik nuanc\u00ed. Za prv\u00e9, proto\u017ee se jedn\u00e1 o NAT v m\u011b\u0159\u00edtku poskytovatele, je nutn\u00e9 upravit timeouty, proto\u017ee p\u0159i v\u00fdchoz\u00edch hodnot\u00e1ch se velikost tabulky p\u0159ekladu rychle zv\u00fd\u0161\u00ed na katastrofick\u00e9 hodnoty. N\u00ed\u017ee je p\u0159\u00edklad nastaven\u00ed, kter\u00e9 jsem pou\u017eil na sv\u00fdch serverech:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1\nnet.ipv4.ip_local_port_range = 8192 65535\n\nnet.netfilter.nf_conntrack_generic_timeout = 300\nnet.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60\nnet.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60\nnet.netfilter.nf_conntrack_tcp_timeout_established = 600\nnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60\nnet.netfilter.nf_conntrack_tcp_timeout_close_wait = 45\nnet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30\nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120\nnet.netfilter.nf_conntrack_tcp_timeout_close = 10\nnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300\nnet.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300\nnet.netfilter.nf_conntrack_udp_timeout = 30\nnet.netfilter.nf_conntrack_udp_timeout_stream = 60\nnet.netfilter.nf_conntrack_icmpv6_timeout = 30\nnet.netfilter.nf_conntrack_icmp_timeout = 30\nnet.netfilter.nf_conntrack_events_retry_timeout = 15\nnet.netfilter.nf_conntrack_checksum=0\n<\/code><\/pre>\n<p>\nA za druh\u00e9, proto\u017ee velikost tabulky p\u0159eklad\u016f ve v\u00fdchoz\u00edm nastaven\u00ed nen\u00ed ur\u010dena pro pr\u00e1ci v podm\u00ednk\u00e1ch telekomunika\u010dn\u00edho oper\u00e1tora, je nutn\u00e9 ji zv\u00fd\u0161it:<\/p>\n<pre><code class=\"plaintext\">net.netfilter.nf_conntrack_max = 3145728\n<\/code><\/pre>\n<p>\n Je tak\u00e9 nutn\u00e9 zv\u00fd\u0161it po\u010det buckets pro hashovac\u00ed tabulku, kter\u00e1 ukl\u00e1d\u00e1 v\u0161echny p\u0159eklady (to je volba modulu nf_conntrack): <\/p>\n<pre><code class=\"plaintext\">options nf_conntrack hashsize=1572864\n<\/code><\/pre>\n<p>\nPo t\u011bchto jednoduch\u00fdch manipulac\u00edch vznik\u00e1 pln\u011b funk\u010dn\u00ed konstrukce, kter\u00e1 m\u016f\u017ee p\u0159ekl\u00e1dat velk\u00e9 mno\u017estv\u00ed klientsk\u00fdch adres do z\u00e1sobn\u00edku extern\u00edch adres. Nicm\u00e9n\u011b, v\u00fdkonnost tohoto \u0159e\u0161en\u00ed z\u016fst\u00e1v\u00e1 nedostate\u010dn\u00e1. V m\u00fdch prvn\u00edch pokusech vyu\u017eit\u00ed GNU\/Linux pro NAT (kolem roku 2013) jsem dok\u00e1zal dos\u00e1hnout v\u00fdkonnosti p\u0159ibli\u017en\u011b 7Gbit\/s p\u0159i 0.8Mpps na jeden server (Xeon E5-1650v2). Od t\u00e9 doby bylo v s\u00ed\u0165ov\u00e9m z\u00e1sobn\u00edku j\u00e1dra GNU\/Linux provedeno mnoho r\u016fzn\u00fdch optimalizac\u00ed, v\u00fdkonnost jednoho serveru na stejn\u00e9m hardwaru vzrostla t\u00e9m\u011b\u0159 na 18-19 Gbit\/s p\u0159i 1.8-1.9 Mpps (to byly krajn\u00ed hodnoty), ale pot\u0159eba objemu provozu zpracov\u00e1van\u00e9ho jedn\u00edm serverem rostla mnohem rychleji. V d\u016fsledku toho byly vypracov\u00e1ny sch\u00e9mata vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee na r\u016fzn\u00e9 servery, ale to v\u0161e zv\u00fd\u0161ilo slo\u017eitost konfigurace, \u00fadr\u017eby a udr\u017een\u00ed kvality poskytovan\u00fdch slu\u017eeb.<\/p>\n<h3>NFTables<\/h3>\n<p>\nAktu\u00e1ln\u00edm trendy v oblasti programov\u00e9ho \u201ep\u0159ebalov\u00e1n\u00ed paket\u016f\u201c je pou\u017e\u00edv\u00e1n\u00ed DPDK a XDP. O t\u00e9to t\u00e9matice bylo naps\u00e1no spousta \u010dl\u00e1nk\u016f, uskute\u010dn\u011bno mnoho r\u016fzn\u00fdch prezentac\u00ed a objevuj\u00ed se komer\u010dn\u00ed produkty (nap\u0159\u00edklad SKAT od VasExperts). Nicm\u00e9n\u011b, v podm\u00ednk\u00e1ch omezen\u00fdch zdroj\u016f program\u00e1tor\u016f u telekomunika\u010dn\u00edch oper\u00e1tor\u016f je pom\u011brn\u011b problematick\u00e9 vyvinout n\u011bjak\u00fd \u201ev\u00fdrobek\u201c na z\u00e1klad\u011b t\u011bchto framework\u016f. Dal\u0161\u00ed vyu\u017e\u00edv\u00e1n\u00ed takov\u00e9ho \u0159e\u0161en\u00ed bude mnohem slo\u017eit\u011bj\u0161\u00ed, p\u0159edev\u0161\u00edm bude nutn\u00e9 vyvinout diagnostick\u00e9 n\u00e1stroje. Nap\u0159\u00edklad standardn\u00ed tcpdump s DPDK prost\u011b nefunguje, a pakety, kter\u00e9 byly odesl\u00e1ny zp\u011bt do dr\u00e1t\u016f pomoc\u00ed XDP, nebudou \u201eviditeln\u00e9\u201c. Na pozad\u00ed v\u0161ech diskuz\u00ed o nov\u00fdch technologi\u00edch sm\u011brov\u00e1n\u00ed paket\u016f do user-space z\u016fstaly bez pov\u0161imnut\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/netdevconf.info\/0x13\/session.html?workshop-netfilter-mini\">p\u0159edn\u00e1\u0161ky<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/738214\/\">na str\u00e1nk\u00e1ch Maven Apache Project<\/a><\/noindex> Pablo Neira Ayuso, udr\u017eovatel iptables, o v\u00fdvoji flow offloading v nftables. Pod\u00edvejme se na tento mechanismus podrobn\u011bji.<\/p>\n<p>Hlavn\u00ed my\u0161lenka spo\u010d\u00edv\u00e1 v tom, \u017ee pokud router propustil pakety jedn\u00e9 relace ob\u011bma sm\u011bry toku (TCP relace p\u0159e\u0161la do stavu ESTABLISHED), nen\u00ed t\u0159eba propou\u0161t\u011bt dal\u0161\u00ed pakety t\u00e9to relace p\u0159es v\u0161echna pravidla firewallu, proto\u017ee v\u0161echny tyto kontroly stejn\u011b skon\u010d\u00ed p\u0159ed\u00e1n\u00edm paketu do sm\u011brov\u00e1n\u00ed. A vlastn\u011b nen\u00ed pot\u0159eba vyb\u00edrat trasu \u2014 u\u017e v\u00edme, na kter\u00e9 rozhran\u00ed a kter\u00e9mu hostiteli je t\u0159eba pakety v r\u00e1mci t\u00e9to relace p\u0159edat. Zb\u00fdv\u00e1 pouze uchovat tyto informace a pou\u017e\u00edt je pro sm\u011brov\u00e1n\u00ed v ran\u00e9 f\u00e1zi zpracov\u00e1n\u00ed paketu. P\u0159i prov\u00e1d\u011bn\u00ed NAT je nav\u00edc nutn\u00e9 uchov\u00e1vat informace o zm\u011bn\u00e1ch adres a port\u016f, kter\u00e9 byly transformov\u00e1ny modulem nf_conntrack. Ano, samoz\u0159ejm\u011b, v tomto p\u0159\u00edpad\u011b p\u0159est\u00e1vaj\u00ed fungovat r\u016fzn\u00e9 policery a dal\u0161\u00ed informa\u010dn\u011b-statistick\u00e1 pravidla v iptables, ale v r\u00e1mci \u00fakolu samostatn\u00e9ho stoj\u00edc\u00edho NAT nebo nap\u0159\u00edklad borderu \u2014 to nen\u00ed tak d\u016fle\u017eit\u00e9, proto\u017ee slu\u017eby jsou distribuov\u00e1ny mezi za\u0159\u00edzen\u00edmi.<\/p>\n<h4>Konfigurace<\/h4>\n<p>\nAbyste mohli vyu\u017e\u00edt tuto funkci, pot\u0159ebujeme:<\/p>\n<ul>\n<li>Pou\u017e\u00edt novou verzi j\u00e1dra. I kdy\u017e se sama funk\u010dnost objevila ji\u017e v j\u00e1d\u0159e 4.16, byla pom\u011brn\u011b dlouho velmi \u201esyrov\u00e1\u201c a pravideln\u011b vyvol\u00e1vala kernel panic. V\u0161e se stabilizovalo p\u0159ibli\u017en\u011b v prosinci 2019, kdy vy\u0161ly LTS verze j\u00e1dra 4.19.90 a 5.4.5.<\/li>\n<li>P\u0159eve\u010fte pravidla iptables do form\u00e1tu nftables pomoc\u00ed dostate\u010dn\u011b nov\u00e9 verze nftables. Funk\u010dn\u00ed v verzi 0.9.0<\/li>\n<\/ul>\n<p>\nPokud je prvn\u00ed bod v z\u00e1sad\u011b jasn\u00fd, hlavn\u011b nezapome\u0148te zahrnout modul do konfigurace p\u0159i sestaven\u00ed (CONFIG_NFT_FLOW_OFFLOAD=m), druh\u00fd bod vy\u017eaduje vysv\u011btlen\u00ed. Pravidla nftables se popisuj\u00ed zcela jinak ne\u017e v iptables. <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Main_Page\">Dokumentace<\/a><\/noindex> odhaluje prakticky v\u0161echny aspekty, tak\u00e9 existuj\u00ed speci\u00e1ln\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Moving_from_iptables_to_nftables\">konvertory<\/a><\/noindex> pravidel z iptables do nftables. Proto uvedu pouze p\u0159\u00edklad nastaven\u00ed NAT a flow offload. Mal\u00e1 legenda pro p\u0159\u00edklad: &lt;i_if&gt;, &lt;o_if&gt; \u2014 to jsou s\u00ed\u0165ov\u00e9 rozhran\u00ed, p\u0159es kter\u00e1 proch\u00e1z\u00ed provoz, ve skute\u010dnosti jich m\u016f\u017ee b\u00fdt v\u00edce ne\u017e dv\u011b. &lt;pool_addr_start&gt;,&lt;pool_addr_end&gt; \u2014 po\u010d\u00e1te\u010dn\u00ed a koncov\u00e1 adresa rozsahu \u201eb\u00edl\u00fdch\u201c adres.<\/p>\n<p>Konfigurace NAT je velmi jednoduch\u00e1:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable nat {\n        chain postrouting {\n                type nat hook postrouting priority 100;\n                oif &lt;o_if&gt; snat to &lt;pool_addr_start&gt;-&lt;pool_addr_end&gt; persistent\n        }\n}\n<\/code><\/pre>\n<p>\nS flow offload je to o n\u011bco slo\u017eit\u011bj\u0161\u00ed, ale docela srozumiteln\u00e9:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable inet filter {\n        flowtable fastnat {\n                hook ingress priority 0\n                devices = { &lt;i_if&gt;, &lt;o_if&gt; }\n        }\n\n        chain forward {\n                type filter hook forward priority 0; policy accept;\n                ip protocol { tcp , udp } flow offload @fastnat;\n        }\n}\n<\/code><\/pre>\n<p>\nA to je vlastn\u011b cel\u00e9 nastaven\u00ed. Nyn\u00ed ve\u0161ker\u00fd TCP\/UDP provoz bude sm\u011b\u0159ov\u00e1n do tabulky fastnat a zpracov\u00e1v\u00e1n mnohem rychleji.<\/p>\n<h3>V\u00fdsledky<\/h3>\n<p>\nAby bylo jasn\u00e9, jak moc je to \u201emnohem rychleji\u201c, p\u0159ipoj\u00edm sn\u00edmek z\u00e1t\u011b\u017ee na dvou skute\u010dn\u00fdch serverech, se stejnou konfigurac\u00ed (Xeon E5-1650v2), stejn\u00fdm nastaven\u00edm, pou\u017e\u00edvaj\u00edc\u00edch j\u00e1dro Linux, ale prov\u00e1d\u011bj\u00edc\u00edch NAT v iptables (NAT4) a v nftables (NAT5).<\/p>\n<p><img decoding=\"async\" alt=\"Rychl\u00e9 sm\u011brov\u00e1n\u00ed a NAT v Linuxu\" src=\"\/wp-content\/uploads\/2020\/05\/94bd3f58bf499ceb9837cd771cc9ef9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa sn\u00edmku nen\u00ed graf paket\u016f za sekundu, ale v profilu zat\u00ed\u017een\u00ed t\u011bchto server\u016f m\u00e1 pr\u016fm\u011brn\u00e1 velikost paketu kolem 800 bajt\u016f, tak\u017ee hodnoty dosahuj\u00ed a\u017e 1.5Mpps. Jak je vid\u011bt, server s nftables m\u00e1 obrovsk\u00fd v\u00fdkonov\u00fd potenci\u00e1l. V sou\u010dasn\u00e9 dob\u011b tento server zpracov\u00e1v\u00e1 a\u017e 30Gbit\/s p\u0159i 3Mpps a je zjevn\u011b schopen narazit na fyzick\u00e9 omezen\u00ed s\u00edt\u011b 40Gbps, p\u0159i\u010dem\u017e m\u00e1 st\u00e1le voln\u00e9 CPU prost\u0159edky.<\/p>\n<p>Douf\u00e1m, \u017ee tento materi\u00e1l bude u\u017eite\u010dn\u00fd s\u00ed\u0165ov\u00fdm in\u017een\u00fdr\u016fm, kte\u0159\u00ed se sna\u017e\u00ed zlep\u0161it v\u00fdkon sv\u00fdch server\u016f.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/501234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rychl\u00e9 sm\u011brov\u00e1n\u00ed a NAT v Linuxu | ProHoster","description":"S vy\u010derp\u00e1n\u00edm IPv4 adres se mnoz\u00ed poskytovatel\u00e9 slu\u017eeb setkali s nutnost\u00ed organizovat p\u0159\u00edstup sv\u00fdch klient\u016f do s\u00edt\u011b pomoc\u00ed p\u0159eklad\u016f adres.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-11T23:42:43+00:00","article:modified_time":"2020-05-11T23:42:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81265","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:01:23","updated":"2022-09-28 04:47:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/81265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=81265"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/81265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/81266"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=81265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=81265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=81265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}