{"id":74655,"date":"2020-03-19T08:42:34","date_gmt":"2020-03-19T05:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh"},"modified":"2020-03-19T08:42:34","modified_gmt":"2020-03-19T05:42:34","slug":"kogda-linux-conntrack-vam-bolshe-ne-tovarishh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","title":{"rendered":"Kui Linuxi conntrack ei ole enam teie s\u00f5ber","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Kui Linuxi conntrack ei ole enam teie s\u00f5ber\" src=\"\/wp-content\/uploads\/2020\/03\/588a169e5cfe0714694b8d7ff03985d1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00dchenduste j\u00e4lgimine (\u201econntrack\u201c) on Linuxi tuumastiku v\u00f5rgu stack'i p\u00f5hifunktsioon. See v\u00f5imaldab tuumal j\u00e4lgida k\u00f5iki loogilisi v\u00f5rgu\u00fchendusi v\u00f5i vooge ning seel\u00e4bi tuvastada k\u00f5ik paketid, mis kuuluvad iga voolu, et neid saaks j\u00e4rjekindlalt \u00fchiselt t\u00f6\u00f6delda.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Conntrack on oluline tuumafunktsioon, mida kasutatakse m\u00f5nes peamises juhtumis:<\/p>\n<p><\/p>\n<ul>\n<li>NAT toetub conntrack'i teabele, et saaks k\u00f5iki sama voolu pakette v\u00f5rdselt t\u00f6\u00f6delda. N\u00e4iteks, kui pod p\u00f6\u00f6rdub Kubernetes'i teenuse poole, kasutab koormuse jaotaja kube-proxy NAT'i, et suunata liiklus konkreetse pod'i poole klastris. Conntrack salvestab, et teatud \u00fchenduse korral peavad k\u00f5ik teenuse IP-le saadetud paketid minema samasse pod'i ning et tagasip\u00f6\u00f6rdunud paketid backend pod'ilt peavad NAT'i kaudu olema suunatud tagasi pod'ile, kust p\u00e4rines p\u00e4ring.<\/li>\n<li>Olemasolevad oleku j\u00e4lgimise tulem\u00fc\u00fcri lahendused, nagu Calico, tuginevad conntrack'i teabele, et lisada \"vastus\" liiklus valgesse nimekirja. See v\u00f5imaldab teil kirjutada v\u00f5rgu poliitika, mis \u00fctleb: \"luba minu pod'il \u00fchenduda mis tahes kaug-IPsse\" ilma vajaduseta kirjutada poliitikat vastusliiklusel selgelt lubamiseks. (Ilma selleta oleksite pidanud lisama palju v\u00e4hem turvalise reegli \"luba pakettide minu pod'ile igast IP-st.\")<\/li>\n<\/ul>\n<p><\/p>\n<p>Lisaks suurendab conntrack tavaliselt s\u00fcsteemi j\u00f5udlust (v\u00e4heneb protsessori aja tarbimine ja paketide viivitus), kuna ainult esimene pakett voos<br \/>\npeab l\u00e4bima kogu v\u00f5rgu virna t\u00f6\u00f6tluse, et m\u00e4\u00e4rata, mida sellega edasi teha. Vaadake postitust \"<noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/blog\/comparing-kube-proxy-modes-iptables-or-ipvs\/\">Kube-proxy re\u017eiimide v\u00f5rdlemine<\/a><\/noindex>\", et n\u00e4ha n\u00e4idet, kuidas see toimib.<\/p>\n<p><\/p>\n<p>Siiski on conntrack'il omad piirangud...<\/p>\n<p><\/p>\n<h3 id=\"itak-gde-vse-poshlo-ne-tak\">Nii et kus see k\u00f5ik valesti l\u00e4ks?<\/h3>\n<p><\/p>\n<p>Conntrack-tabelil on seadistatav maksimaalne suurus ja kui see on t\u00e4is, hakkavad \u00fchendused tavaliselt tagasi l\u00fckkuma v\u00f5i katki minema. Enamik rakendusi vajab tavaliselt vaid piisavalt ruumi ja see ei muutugi probleemiks. Siiski on m\u00f5ned stsenaariumid, kus peaksite m\u00f5tlema conntrack-tabeli kasutamisele:<\/p>\n<p><\/p>\n<ul>\n<li>K\u00f5ige ilmsem juhtum on see, kui teie server t\u00f6\u00f6tleb erakordselt suurt hulka samal ajal aktiivseid \u00fchendusi. N\u00e4iteks kui teie conntrack-tabel on seadistatud 128k kirje jaoks, kuid teil on &gt; 128k samal ajal \u00fchendusi, siis kindlasti kogete probleemi!<\/li>\n<li>Veidi v\u00e4hem ilmne juhtum: kui teie server t\u00f6\u00f6tab v\u00e4ga suure hulga \u00fchendustega sekundis. Isegi kui \u00fchendused on l\u00fchiajalised, j\u00e4lgib Linux neid mingi aja jooksul (vaikimisi 120s). N\u00e4iteks kui teie conntrack-tabel on seadistatud 128 000 kirje jaoks ja proovite t\u00f6\u00f6delda 1100 \u00fchendust sekundis, \u00fcletavad need conntrack-tabeli suurust, isegi kui \u00fchendused on v\u00e4ga l\u00fchiajalised (128k \/ 120s = 1092 \u00fchendust \/ s).<\/li>\n<\/ul>\n<p><\/p>\n<p>On neid mitmeid ni\u0161irakenduste t\u00fc\u00fcpe, mis kuuluvad nende kategooriate alla. Kui teil on palju vaenlasi, siis v\u00f5ib teie serveri conntrack-tabeli t\u00e4itmine poolavatud \u00fchendustega olla osa teenuse keelamise (DOS) r\u00fcnnakust. M\u00f5lemas olukorras v\u00f5ib conntrack-aega olla teie s\u00fcsteemis kitsaskohaks. M\u00f5nel juhul piisab conntrack-tabeli parameetrite seadistamisest - suuruse suurendamine v\u00f5i ajak\u00e4\u00e4ride l\u00fchendamine v\u00f5ib teie vajadusi rahuldada (kuid kui teete selle valesti, v\u00f5ib see p\u00f5hjustada suuri probleeme). Teistes olukordades on vajalik conntrack-i m\u00f6\u00f6da p\u00e4\u00e4seda agressiivse liikluse jaoks.<\/p>\n<p><\/p>\n<h4 id=\"realnyy-primer\">Tegelik n\u00e4ide<\/h4>\n<p><\/p>\n<p>Toome konkreetselt v\u00e4lja: \u00fcks suur SaaS-teenusepakkuja, kellega me t\u00f6\u00f6tasime, omas mitmeid memcached-servereid f\u00fc\u00fcsilistes hostides (mitte virtuaalmasinates), millest iga\u00fcks t\u00f6\u00f6tles \u00fcle 50 000 l\u00fchiajalist \u00fchendust sekundis.<\/p>\n<p><\/p>\n<p>Nad eksperimenteerisid conntracki konfiguratsiooniga, suurendasid tabelite suurusi ja l\u00fchendasid j\u00e4lgimisaja, kuid konfiguratsioon oli ebastabiilne, mille tulemusena suurenes m\u00e4lukasutus m\u00e4rkimisv\u00e4\u00e4rselt (mitu gigabaiti!), ning seosed olid nii l\u00fchikesed, et conntrack ei suutnud saavutada oma tavap\u00e4raseid j\u00f5udluse eeliseid (protsessori tarbimise v\u00f5i paketilooduse v\u00e4henemine).<\/p>\n<p><\/p>\n<p>Alternatiivina p\u00f6\u00f6rdusid nad Calico poole. Calico v\u00f5rgupoliitikad v\u00f5imaldavad konkreetse liikluse t\u00fc\u00fcbi osas conntracki mitte kasutada (kasutades poliitikate seadistamisel doNotTrack valikut). See tagas neile vajaliku j\u00f5udluse taseme koos t\u00e4iendava turvalisusega, mida pakkus Calico.<\/p>\n<p><\/p>\n<h4 id=\"na-chto-pridetsya-poyti-chtoby-oboyti-conntrack\">Mille nimel tuleb conntracki \u00fcletamiseks vaeva n\u00e4ha?<\/h4>\n<p><\/p>\n<ul>\n<li>Do-not-track v\u00f5rgupoliitikad peavad tavaliselt olema s\u00fcmmeetrilised. SaaS-teenusepakkuja puhul t\u00f6\u00f6tasid nende rakendused kaitstud tsoonis ja seet\u00f5ttu said nad v\u00f5rgupoliitika abil valge nimekirja lisada liiklust teistelt konkreetselt m\u00e4\u00e4ratud rakendustelt, millele oli lubatud juurdep\u00e4\u00e4s memcachedile.<\/li>\n<li>Do-not-track poliitika ei arvesta \u00fchenduse suunda. Seega, kui memcached-serverit rikutakse, v\u00f5ib teoorias proovida \u00fchendust luua mistahes memcached-klientidega, kui need kasutavad \u00f5iget l\u00e4hteportaali. Kuid kui olete \u00f5igesti m\u00e4\u00e4ratlenud oma memcached-klientide v\u00f5rgu poliitika, siis need \u00fchenduse loomise katsed l\u00fckatakse ikkagi kliendi poolt tagasi.<\/li>\n<li>Do-not-track poliitika kehtib igale paketile, erinevalt tavalistest poliitikutest, mis kehtivad ainult voogude esimeses paketis. See v\u00f5ib suurendada CPU ressursikulu \u00fches paketis, kuna iga paketi jaoks tuleb poliitika rakendada. Kuid l\u00fchiajaliste \u00fchenduste puhul tasakaalustatakse see ressursside kulu v\u00e4henemisega, mis on seotud conntracki t\u00f6\u00f6tlemisega. N\u00e4iteks, SaaS-teenuse pakkuja puhul oli iga\u00fchenduse paketihulk v\u00e4ga v\u00e4ike, seega oli t\u00e4iendav CPU ressursside kulu poliitikate rakendamisel igale paketile p\u00f5hjendatud.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"pristupim-k-testam\">Alustame testidega<\/h4>\n<p><\/p>\n<p>Me viisime l\u00e4bi testi \u00fche pod'i memcached-serveriga ja paljude pod'ide memcached-klientidega, mis olid k\u00e4imas eemal asuvatel nodedel, et saaksime sekundis luua v\u00e4ga suurt hulka \u00fchendusi. Memcached-serveriga pod'il oli 8 tuuma ja 512k kirjet conntrack'i tabelis (standardseadistusega tabeli suurus hosti jaoks).<br \/>\nM\u00f5\u00f5tsime j\u00f5udluse erinevust j\u00e4rgmiste vahel: ilma v\u00f5rgu poliitikata; tavalise Calico poliitikaga; ja Calico do-not-track poliitikaga.<\/p>\n<p><\/p>\n<p>Esimese testi jaoks seadsime \u00fchenduste arvu 4.000 sekundi kohta, et saaksime keskenduda CPU tarbimise erinevusele. Siin ei olnud olulisi erinevusi poliitika puudumise ja tava poliitika vahel, kuid do-not-track t\u00f5stis CPU tarbimist umbes 20% v\u00f5rra.<\/p>\n<p>\n<img decoding=\"async\" alt=\"Kui Linuxi conntrack ei ole enam teie s\u00f5ber\" src=\"\/wp-content\/uploads\/2020\/03\/6762772cb8e5f089a3ed444aff8cb8f4.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Teises testis k\u00e4ivitasime nii palju \u00fchendusi, kui meie kliendid suudavad genereerida, ja m\u00f5\u00f5tsime maksimaalset \u00fchenduste arvu sekundis, mida meie memcached-server suudab t\u00f6\u00f6delda. Nagu oodata v\u00f5is, saavutasid 'ilma poliitikateta' ja 'tavalise poliitika' puhul m\u00f5lemad conntracki piiri, \u00fcletades 4000 \u00fchendust sekundis (512k \/ 120s = 4369 \u00fchendust\/s). 'Do-not-track' poliitikaga saatsid meie kliendid 60,000 \u00fchendust sekundis ilma igasuguste probleemideta. Oleme kindlad, et v\u00f5iksime seda numbrit suurendada, \u00fchendades rohkem kliente, kuid arvame, et need numbrid on juba piisavad, et illustreerida selle artikli s\u00f5numit!<\/p>\n<p>\n<img decoding=\"async\" alt=\"Kui Linuxi conntrack ei ole enam teie s\u00f5ber\" src=\"\/wp-content\/uploads\/2020\/03\/f3beeb1793a3158018274079da953a2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h4 id=\"zaklyuchenie\">Kokkuv\u00f5te<\/h4>\n<p><\/p>\n<p>Conntrack on oluline funktsioon kernelis. See t\u00e4idab oma \u00fclesannet suurep\u00e4raselt. Sageli kasutavad seda s\u00fcsteemi peamised komponendid. Kuid teatud stsenaariumites v\u00f5ivad conntracki t\u00f5ttu tekkivad \u00fclekoormused kaaluda \u00fcles tavap\u00e4rased eelised, mida see pakub. Sellises stsenaariumis saab Calico v\u00f5rgu poliitikaid kasutada, et valikuliselt keelata conntracki kasutamine, samal ajal suurendades v\u00f5rgu turvalisust. K\u00f5ikjal mujal liikluses j\u00e4\u00e4b conntrack siiski teie s\u00f5braks!<\/p>\n<p><\/p>\n<h2 id=\"takzhe-chitayte-drugie-stati-v-nashem-bloge\">Vaata ka teisi artikleid meie blogis:<\/h2>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473578\/\">D\u00fcnaamiliste moodulite koostamine Nginxile<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/473014\/\">Sissejuhatus Hashicorp Consul's Kubernetes volitusele<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/426543\/\">Stateful varukoopiad Kuberneteses<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/424717\/\">Suurte ja erinevate veebiprojektide varundamine<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/347526\/\">Telegrami bot Redmine'ile. Kuidas elu endale ja teistele lihtsamaks teha<\/a><\/noindex><\/li>\n<\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/nixys\/blog\/492686\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-19T05:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Kui Linux conntrack ei ole enam s\u00f5ber | ProHoster","description":"\u00dchenduste j\u00e4lgimine (\"conntrack\") on peamine funktsioon Linuxi tuumav\u00f5rgustikus. See v\u00f5imaldab tuumal j\u00e4lgida k\u00f5iki loogilisi v\u00f5rgu\u00fchendusi v\u00f5i vooge ja seel\u00e4bi tuvastada k\u00f5ik paketid, mis moodustavad iga voogu, et neid saaks j\u00e4rjestikku t\u00f6\u00f6delda. Conntrack on oluline tuumafunktsioon, mida kasutatakse m\u00f5nedes p\u00f5hijuhtumites: NAT toetub conntrack'i teabele.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 Linux conntrack \u0432\u0430\u043c \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u0442\u043e\u0432\u0430\u0440\u0438\u0449 | ProHoster","og:description":"\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (\u201cconntrack\u201d) \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u044f\u0434\u0440\u0430 Linux. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u0443 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u043e\u0442\u043e\u043a\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u043e\u0442\u043e\u043a, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u043c\u0435\u0441\u0442\u0435. Conntrack \u2014 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445: NAT \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0441onntrack,","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kogda-linux-conntrack-vam-bolshe-ne-tovarishh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-19T05:42:34+00:00","article:modified_time":"2020-03-19T05:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74655","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:10:25","updated":"2022-10-05 19:52:30"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74655"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/74656"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}