{"id":81265,"date":"2020-05-12T01:42:43","date_gmt":"2020-05-11T23:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux"},"modified":"2020-05-12T01:42:43","modified_gmt":"2020-05-11T23:42:43","slug":"bystryj-routing-i-nat-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","title":{"rendered":"Routing veloce e NAT in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Con l'esaurimento degli indirizzi IPv4, molti operatori di telecomunicazioni si sono trovati nella necessit\u00e0 di fornire accesso alla rete per i propri clienti mediante la traduzione degli indirizzi. In questo articolo, spiegher\u00f2 come ottenere prestazioni a livello Carrier Grade NAT su server di tipo commodity.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Un po' di storia<\/h3>\n<p>\nIl tema della scarsit\u00e0 degli indirizzi IPv4 non \u00e8 nuovo. A un certo punto, presso RIPE, sono apparse liste di attesa, seguite da mercati in cui venivano scambiati blocchi di indirizzi e si stipulavano contratti per il loro affitto. Gradualmente, gli operatori di telecomunicazioni hanno iniziato a offrire servizi di accesso a Internet tramite la traduzione di indirizzi e porte. Alcuni non sono riusciti ad ottenere abbastanza indirizzi per fornire un indirizzo \"bianco\" a ogni abbonato, mentre altri hanno iniziato a risparmiare, rinunciando all'acquisto di indirizzi nel mercato secondario. I produttori di apparecchiature di rete hanno sostenuto questa idea, poich\u00e9 questa funzionalit\u00e0 richiede solitamente moduli di espansione aggiuntivi o licenze. Ad esempio, nei router MX di Juniper (esclusi i pi\u00f9 recenti MX104 e MX204), l'esecuzione di NAPT pu\u00f2 avvenire su una carta di servizio separata MS-MIC, su Cisco ASR1k \u00e8 necessaria una licenza CGN, mentre su Cisco ASR9k \u00e8 richiesto un modulo separato A9K-ISM-100 e la licenza A9K-CGN-LIC associata. In generale, questa funzionalit\u00e0 ha un costo significativo.<\/p>\n<h3>IPTables<\/h3>\n<p>\nL'esecuzione del NAT non richiede risorse di calcolo specializzate; pu\u00f2 essere gestita da processori di uso generale, come quelli presenti in qualsiasi router domestico. Su scala dell'operatore di telecomunicazioni, questa attivit\u00e0 pu\u00f2 essere svolta utilizzando server commodity che funzionano con FreeBSD (ipfw\/pf) o GNU\/Linux (iptables). Non tratteremo FreeBSD poich\u00e9 ho smesso di utilizzare questo sistema operativo da tempo, quindi ci concentreremo su GNU\/Linux.<\/p>\n<p>Attivare la traduzione degli indirizzi non \u00e8 affatto complicato. Innanzitutto, \u00e8 necessario scrivere una regola in iptables nella tabella nat:<\/p>\n<pre><code class=\"bash\">iptables -t nat -A POSTROUTING -s 100.64.0.0\/10 -j SNAT --to - --persistent\n<\/code><\/pre>\n<p>\n\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442 \u043c\u043e\u0434\u0443\u043b\u044c nf_conntrack, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f. \u0422\u0443\u0442 \u0435\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u043e\u043d\u043a\u043e\u0441\u0442\u0435\u0439. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e NAT \u0432 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u0432\u044f\u0437\u0438, \u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u043a\u0440\u0443\u0442\u0438\u0442\u044c timeout&#8217;\u044b, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0441\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0430\u0437\u043c\u0435\u0440 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0439 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u0440\u0430\u0441\u0442\u0435\u0442 \u0434\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439. \u041d\u0438\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u0440 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1\nnet.ipv4.ip_local_port_range = 8192 65535\n\nnet.netfilter.nf_conntrack_generic_timeout = 300\nnet.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60\nnet.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60\nnet.netfilter.nf_conntrack_tcp_timeout_established = 600\nnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60\nnet.netfilter.nf_conntrack_tcp_timeout_close_wait = 45\nnet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30\nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120\nnet.netfilter.nf_conntrack_tcp_timeout_close = 10\nnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300\nnet.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300\nnet.netfilter.nf_conntrack_udp_timeout = 30\nnet.netfilter.nf_conntrack_udp_timeout_stream = 60\nnet.netfilter.nf_conntrack_icmpv6_timeout = 30\nnet.netfilter.nf_conntrack_icmp_timeout = 30\nnet.netfilter.nf_conntrack_events_retry_timeout = 15\nnet.netfilter.nf_conntrack_checksum=0\n<\/code><\/pre>\n<p>\nIn secondo luogo, poich\u00e9 per impostazione predefinita la dimensione della tabella delle traduzioni non \u00e8 calcolata per funzionare nelle condizioni di un operatore di rete, \u00e8 necessario aumentarla:<\/p>\n<pre><code class=\"plaintext\">net.netfilter.nf_conntrack_max = 3145728\n<\/code><\/pre>\n<p>\n \u00c8 anche necessario aumentare il numero di buckets per la hash table che memorizza tutte le traduzioni (questo \u00e8 un'opzione del modulo nf_conntrack): <\/p>\n<pre><code class=\"plaintext\">options nf_conntrack hashsize=1572864\n<\/code><\/pre>\n<p>\nDopo queste semplici operazioni, si ottiene una struttura perfettamente funzionante che pu\u00f2 tradurre un gran numero di indirizzi client in un pool esterno. Tuttavia, le prestazioni di questa soluzione lasciano a desiderare. Nei miei primi tentativi di utilizzo di GNU\/Linux per NAT (circa nel 2013) sono riuscito a ottenere prestazioni di circa 7 Gbit\/s a 0.8 Mpps su un singolo server (Xeon E5-1650v2). Da allora, nel stack di rete del kernel GNU\/Linux sono state apportate molte ottimizzazioni diverse, e le prestazioni di un singolo server sulla stessa hardware sono aumentate praticamente a 18-19 Gbit\/s a 1.8-1.9 Mpps (questi erano valori di punta), ma la richiesta per il volume di traffico gestito da un singolo server cresceva molto pi\u00f9 rapidamente. Alla fine sono state sviluppate schemi di bilanciamento del carico su diversi server, ma tutto ci\u00f2 ha aumentato la complessit\u00e0 di configurazione, manutenzione e mantenimento della qualit\u00e0 dei servizi offerti.<\/p>\n<h3>NFTables<\/h3>\n<p>\nAttualmente, una tendenza popolare nella programmazione per 'trasferire pacchetti' \u00e8 l'uso di DPDK e XDP. Sono stati scritti molti articoli a riguardo, si sono tenuti diversi interventi e sono emersi prodotti commerciali (come SKAT di VasExperts). Tuttavia, con risorse limitate a disposizione dei programmatori delle telecomunicazioni, \u00e8 piuttosto complicato sviluppare autonomamente qualche 'articolo' basato su questi framework. Inoltre, sfruttare tale soluzione in seguito sar\u00e0 molto pi\u00f9 difficile, in particolare perch\u00e9 sar\u00e0 necessario sviluppare strumenti di diagnostica. Ad esempio, il tcpdump standard non funzioner\u00e0 con DPDK, e i pacchetti inviati indietro attraverso i cavi con XDP non saranno 'visibili'. Tra tutte queste conversazioni sulle nuove tecnologie per l'inoltro dei pacchetti nello user-space, sono rimasti inosservati <noindex><a rel=\"nofollow\" href=\"https:\/\/netdevconf.info\/0x13\/session.html?workshop-netfilter-mini\">relazioni<\/a><\/noindex> e <noindex><a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/738214\/\">articolo<\/a><\/noindex> Pablo Neira Ayuso, il maintainer di iptables, riguardo allo sviluppo del flow offloading in nftables. Esaminiamo questo meccanismo pi\u00f9 in dettaglio.<\/p>\n<p>L'idea principale \u00e8 che se un router ha passato pacchetti di una sessione in entrambe le direzioni del flusso (la sessione TCP \u00e8 passata allo stato ESTABLISHED), non c'\u00e8 bisogno di lasciare che i pacchetti successivi di questa sessione passino attraverso tutte le regole del firewall, poich\u00e9 tutti questi controlli si concluderanno comunque con la trasmissione del pacchetto verso il routing. Inoltre, non \u00e8 necessario nemmeno scegliere un percorso \u2014 sappiamo gi\u00e0 quale interfaccia e a quale host inviare i pacchetti all'interno di questa sessione. Resta solo da mantenere queste informazioni e utilizzarle per la routing nelle prime fasi di elaborazione del pacchetto. Durante l'esecuzione del NAT \u00e8 necessario anche conservare le informazioni sui cambiamenti degli indirizzi e delle porte, trasformati dal modulo nf_conntrack. Certamente, in questo caso smettono di funzionare diversi poliser e altre regole informative e statistiche in iptables, ma nell'ambito di una specifica esigenza di NAT isolato o, ad esempio, di un confine \u2014 questo non \u00e8 cos\u00ec importante, poich\u00e9 i servizi sono distribuiti su pi\u00f9 dispositivi.<\/p>\n<h4>Configurazione<\/h4>\n<p>\nPer utilizzare questa funzione dobbiamo:<\/p>\n<ul>\n<li>Utilizza un kernel aggiornato. Anche se questa funzionalit\u00e0 \u00e8 apparsa per la prima volta nel kernel 4.16, \u00e8 rimasta piuttosto \"instabile\" a lungo, causando regolarmente kernel panic. La situazione \u00e8 migliorata circa a dicembre 2019, con il rilascio dei kernel LTS 4.19.90 e 5.4.5.<\/li>\n<li>Riscrivere le regole iptables nel formato nftables, utilizzando una versione di nftables relativamente recente. Funziona correttamente dalla versione 0.9.0.<\/li>\n<\/ul>\n<p>\nSe il primo punto \u00e8 relativamente chiaro, e l'importante \u00e8 non dimenticare di abilitare il modulo nella configurazione durante la compilazione (CONFIG_NFT_FLOW_OFFLOAD=m), il secondo punto richiede ulteriori spiegazioni. Le regole di nftables sono descritte in modo diverso rispetto a quelle di iptables. <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Main_Page\">Documentazione<\/a><\/noindex> sfacciatamente, ci sono anche dei convertitori <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Moving_from_iptables_to_nftables\">di regole da iptables a nftables. Pertanto, fornir\u00f2 solo un esempio di configurazione NAT e flow offload. Una piccola legenda per l'esempio: &lt;i_if&gt;, &lt;o_if&gt; sono interfacce di rete attraverso cui passa il traffico, in realt\u00e0 possono essercene pi\u00f9 di due. &lt;pool_addr_start&gt;, &lt;pool_addr_end&gt; \u2014 sono l'indirizzo iniziale e finale dell'intervallo di indirizzi \"pubblici\".<\/a><\/noindex> \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u0437 iptables \u0432 nftables. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u043f\u0440\u0438\u0432\u0435\u0434\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438\u043c\u0435\u0440 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 NAT \u0438 flow offload. \u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u043b\u0435\u0433\u0435\u043d\u0434\u0430 \u0434\u043b\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u0430: &lt;i_if&gt;, &lt;o_if&gt; \u2014 \u044d\u0442\u043e \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0442\u0440\u0430\u0444\u0438\u043a, \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0438\u0445 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0434\u0432\u0443\u0445. &lt;pool_addr_start&gt;,&lt;pool_addr_end&gt; \u2014 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0439 \u0430\u0434\u0440\u0435\u0441 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u00ab\u0431\u0435\u043b\u044b\u0445\u00bb \u0430\u0434\u0440\u0435\u0441\u043e\u0432.<\/p>\n<p>La configurazione NAT \u00e8 molto semplice:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable nat {\n        chain postrouting {\n                type nat hook postrouting priority 100;\n                oif &lt;o_if&gt; snat to &lt;pool_addr_start&gt;-&lt;pool_addr_end&gt; persistent\n        }\n}\n<\/code><\/pre>\n<p>\nCon il flow offload \u00e8 un po' pi\u00f9 complicato, ma comunque chiaro:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable inet filter {\n        flowtable fastnat {\n                hook ingress priority 0\n                devices = { &lt;i_if&gt;, &lt;o_if&gt; }\n        }\n\n        chain forward {\n                type filter hook forward priority 0; policy accept;\n                ip protocol { tcp , udp } flow offload @fastnat;\n        }\n}\n<\/code><\/pre>\n<p>\nEcco, questa \u00e8 l'intera configurazione. Ora tutto il traffico TCP\/UDP passer\u00e0 attraverso la tabella fastnat e sar\u00e0 elaborato molto pi\u00f9 rapidamente.<\/p>\n<h3>Risultati<\/h3>\n<p>\nPer far comprendere quanto sia 'notevolmente pi\u00f9 veloce', allegher\u00f2 uno screenshot del carico su due server reali, con la stessa configurazione (Xeon E5-1650v2), configurati in modo identico, che utilizzano lo stesso kernel di Linux, ma che eseguono NAT in iptables (NAT4) e in nftables (NAT5).<\/p>\n<p><img decoding=\"async\" alt=\"Routing veloce e NAT in Linux\" src=\"\/wp-content\/uploads\/2020\/05\/94bd3f58bf499ceb9837cd771cc9ef9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNello screenshot non \u00e8 presente il grafico dei pacchetti al secondo, ma nel profilo di carico di questi server la dimensione media del pacchetto \u00e8 di circa 800 byte, quindi i valori raggiungono fino a 1.5Mpps. Come si pu\u00f2 vedere, la capacit\u00e0 di prestazione del server con nftables \u00e8 enorme. Attualmente, questo server gestisce fino a 30Gbit\/s a 3Mpps ed \u00e8 chiaramente in grado di raggiungere il limite fisico della rete di 40Gbps, avendo al contempo risorse CPU disponibili.<\/p>\n<p>Spero che questo materiale sia utile agli ingegneri di rete che cercano di migliorare le prestazioni dei propri server.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/501234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Routing veloce e NAT in Linux | ProHoster","description":"Con l'esaurimento degli indirizzi IPv4, molti operatori di rete hanno dovuto organizzare l'accesso dei loro clienti alla rete tramite la traduzione degli indirizzi. In questo articolo vi spiegher\u00f2 come ottenere prestazioni a livello Carrier Grade NAT su server comuni. Un po' di storia Il tema dell'esaurimento dello spazio indirizzi IPv4 non \u00e8 nuovo. Ad un certo punto, nella RIPE, sono apparse liste di attesa.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-11T23:42:43+00:00","article:modified_time":"2020-05-11T23:42:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81265","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:01:23","updated":"2022-09-28 04:47:17"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/81265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=81265"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/81265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/81266"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=81265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=81265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=81265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}