{"id":81265,"date":"2020-05-12T01:42:43","date_gmt":"2020-05-11T23:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux"},"modified":"2020-05-12T01:42:43","modified_gmt":"2020-05-11T23:42:43","slug":"bystryj-routing-i-nat-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","title":{"rendered":"\u0100tra mar\u0161rut\u0113\u0161ana un NAT Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>L\u012bdz ar IPv4 adreses izs\u012bk\u0161anu, daudzi telekomunik\u0101ciju operatori sask\u0101r\u0101s ar nepiecie\u0161am\u012bbu organiz\u0113t piek\u013cuvi saviem klientiem internetam, izmantojot adresu tulko\u0161anu. \u0160aj\u0101 rakst\u0101 es past\u0101st\u012b\u0161u, k\u0101 var sasniegt Carrier Grade NAT veiktsp\u0113ju uz parastajiem serveriem.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Mazliet v\u0113stures<\/h3>\n<p>\nT\u0113ma par IPv4 adres\u0101cijas telpas izs\u012bku\u0161anu jau nav jauna. K\u0101d\u0101 br\u012bd\u012b RIPE par\u0101d\u012bj\u0101s gaid\u012b\u0161anas saraksti, p\u0113c tam izveidoj\u0101s bir\u017eas, kur\u0101s tirgoja adresu blokos un nosl\u0113dza l\u012bgumus par to nomu. Pak\u0101peniski telekomunik\u0101ciju operatori s\u0101ka pied\u0101v\u0101t interneta piek\u013cuves pakalpojumus, izmantojot adresu un portu tulko\u0161anu. K\u0101ds nesagaid\u012bja pietiekami daudz adreses, lai katram abonentam pie\u0161\u0137irtu \u201ebaltu\u201d adresi, bet citi s\u0101ka ietaup\u012bt l\u012bdzek\u013cus, atteicoties no adresu ieg\u0101des sekund\u0101raj\u0101 tirg\u016b. T\u012bkla aparat\u016bras ra\u017eot\u0101ji atbalst\u012bja \u0161o ideju, jo \u0161\u012b funkcionalit\u0101te parasti prasa papildu papla\u0161in\u0101\u0161anas modu\u013cus vai licences. Piem\u0113ram, Juniper MX mar\u0161rut\u0113t\u0101ju s\u0113rij\u0101 (iz\u0146emot jaun\u0101kos MX104 un MX204) NAPT var veikt uz atsevi\u0161\u0137as MS-MIC pakalpojumu kartes, bet Cisco ASR1k ir nepiecie\u0161ama CGN licence, savuk\u0101rt Cisco ASR9k - atsevi\u0161\u0137s A9K-ISM-100 modulis un licence A9K-CGN-LIC tam. Kopum\u0101 prieks maks\u0101 d\u0101rgi.<\/p>\n<h3>IPTables<\/h3>\n<p>\nNAT uzdevums neprasa specializ\u0113tus apr\u0113\u0137inu resursus; to sp\u0113j risin\u0101t visp\u0101r\u0113j\u0101s lieto\u0161anas procesori, kas uzst\u0101d\u012bti, piem\u0113ram, jebkur\u0101 m\u0101jas mar\u0161rut\u0113t\u0101j\u0101. Telekomunik\u0101ciju operatora m\u0113rog\u0101 \u0161o uzdevumu var risin\u0101t, izmantojot parastus serverus, kas darbojas ar FreeBSD (ipfw\/pf) vai GNU\/Linux (iptables). FreeBSD m\u0113s neapskat\u012bsim, jo es diezgan sen atteicos no \u0161\u012bs oper\u0113t\u0101jsist\u0113mas izmanto\u0161anas, t\u0101p\u0113c apst\u0101simies pie GNU\/Linux.<\/p>\n<p>Iesl\u0113gt adresu tulko\u0161anu visp\u0101r nav gr\u016bti. Vispirms ir nepiecie\u0161ams defin\u0113t noteikumu iptables nat tabul\u0101:<\/p>\n<pre><code class=\"bash\">iptables -t nat -A POSTROUTING -s 100.64.0.0\/10 -j SNAT --to - --persistent\n<\/code><\/pre>\n<p>\nOper\u0113t\u0101jsist\u0113ma iel\u0101d\u0113s nf_conntrack modu\u013cu, kas uzraudz\u012bs visus akt\u012bvos savienojumus un veiks nepiecie\u0161am\u0101s p\u0101rv\u0113rt\u012bbas. \u0160eit ir da\u017eas nianses. Pirmk\u0101rt, \u0146emot v\u0113r\u0101, ka runa ir par NAT sakaru operatoru m\u0113rog\u0101, ir nepiecie\u0161ams noregul\u0113t timeout v\u0113rt\u012bbas, jo ar noklus\u0113juma v\u0113rt\u012bb\u0101m tulkojumu tabulas izm\u0113rs diezgan \u0101tri pieaugs l\u012bdz katastrof\u0101liem izm\u0113riem. Zem\u0101k ir piem\u0113rs iestat\u012bjumiem, kurus es izmantoju savos serveros:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1\nnet.ipv4.ip_local_port_range = 8192 65535\n\nnet.netfilter.nf_conntrack_generic_timeout = 300\nnet.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60\nnet.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60\nnet.netfilter.nf_conntrack_tcp_timeout_established = 600\nnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60\nnet.netfilter.nf_conntrack_tcp_timeout_close_wait = 45\nnet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30\nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120\nnet.netfilter.nf_conntrack_tcp_timeout_close = 10\nnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300\nnet.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300\nnet.netfilter.nf_conntrack_udp_timeout = 30\nnet.netfilter.nf_conntrack_udp_timeout_stream = 60\nnet.netfilter.nf_conntrack_icmpv6_timeout = 30\nnet.netfilter.nf_conntrack_icmp_timeout = 30\nnet.netfilter.nf_conntrack_events_retry_timeout = 15\nnet.netfilter.nf_conntrack_checksum=0\n<\/code><\/pre>\n<p>\nOtrk\u0101rt, \u0146emot v\u0113r\u0101, ka noklus\u0113juma p\u0101rtver\u0161anas tabulas izm\u0113rs nav paredz\u0113ts darbam sakaru operatora apst\u0101k\u013cos, to nepiecie\u0161ams palielin\u0101t:<\/p>\n<pre><code class=\"plaintext\">net.netfilter.nf_conntrack_max = 3145728\n<\/code><\/pre>\n<p>\n T\u0101pat j\u0101palielina ar\u012b grozu skaits hesh-tabul\u0101, kas glab\u0101 visas p\u0101rtver\u0161anas (\u0161\u012b ir nf_conntrack modu\u013ca opcija): <\/p>\n<pre><code class=\"plaintext\">options nf_conntrack hashsize=1572864\n<\/code><\/pre>\n<p>\nP\u0113c \u0161\u012bm nekomplic\u0113taj\u0101m manipul\u0101cij\u0101m izveidojas diezgan funkcion\u0113jo\u0161a konstrukcija, kas var p\u0101rtvert lielu skaitu klientu adreses uz \u0101r\u0113jo adres\u0101ciju. Tom\u0113r \u0161\u012b risin\u0101juma veiktsp\u0113ja atst\u0101j ko v\u0113l\u0113ties. Man\u0101s pirmaj\u0101s centienos izmantot GNU\/Linux NAT (apm\u0113ram 2013. gad\u0101) izdev\u0101s sasniegt veiktsp\u0113ju ap 7Gbit\/s pie 0.8Mpps uz vienu serveri (Xeon E5-1650v2). Kop\u0161 t\u0101 laika GNU\/Linux kodola t\u012bkla steka ir veikts daudz da\u017e\u0101du optimiz\u0101ciju, un viena servera veiktsp\u0113ja ar to pa\u0161u aparat\u016bru ir pieaugusi gandr\u012bz l\u012bdz 18-19 Gbit\/s pie 1.8-1.9 Mpps (tie bija robe\u017ev\u0113rt\u012bbas), ta\u010du piepras\u012bjums p\u0113c trafika apjoma, ko apstr\u0101d\u0101 viens serveris, pieauga daudz \u0101tr\u0101k. Beig\u0101s tika izstr\u0101d\u0101tas slodzes sadales sh\u0113mas da\u017e\u0101diem serveriem, ta\u010du tas viss palielin\u0101ja konfigur\u0101cijas, apkalpo\u0161anas un sniegto pakalpojumu kvalit\u0101tes uztur\u0113\u0161anas sare\u017e\u0123\u012bt\u012bbu.<\/p>\n<h3>NFTables<\/h3>\n<p>\n\u0160obr\u012bd popul\u0101r\u0101 tendence programm\u0113\u0161an\u0101 \"paketi p\u0101rcel\u0161anas\" jom\u0101 ir DPDK un XDP izmanto\u0161ana. Par \u0161o t\u0113mu ir uzrakst\u012bts daudz rakstu, notiku\u0161as da\u017e\u0101das uzst\u0101\u0161an\u0101s, par\u0101d\u0101s komerci\u0101li produkti (piem\u0113ram, SKAT no VasExperts). Ta\u010du, \u0146emot v\u0113r\u0101 ierobe\u017eotos resursus, kas ir pieejami sakaru operatoru programm\u0113t\u0101jiem, izstr\u0101d\u0101t kaut ko pa\u0161u uz \u0161o ietvaru b\u0101zes ir diezgan sare\u017e\u0123\u012bti. Turpm\u0101k izmantot \u0161\u0101du risin\u0101jumu b\u016bs iev\u0113rojami gr\u016bt\u0101k, jo b\u016bs j\u0101sagatavo diagnostikas r\u012bki. Piem\u0113ram, standarta tcpdump ar DPDK vienk\u0101r\u0161i nedarbosies, un ar\u012b paketi, kas nos\u016bt\u012btas atpaka\u013c vados, izmantojot XDP, tas neredz\u0113s. Visiem \u0161iem run\u0101m par jaun\u0101m tehnolo\u0123ij\u0101m paketu p\u0101rs\u016bt\u012b\u0161an\u0101 lietot\u0101ja telp\u0101, palika nepaman\u012btas <noindex><a rel=\"nofollow\" href=\"https:\/\/netdevconf.info\/0x13\/session.html?workshop-netfilter-mini\">zi\u0146ojumi<\/a><\/noindex> un <noindex><a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/738214\/\">raksti<\/a><\/noindex> Pablo Neira Ayuso, iptables uztur\u0113t\u0101js, par flow offloading izstr\u0101di nftables. Apskat\u012bsim \u0161o meh\u0101nismu s\u012bk\u0101k.<\/p>\n<p>Galven\u0101 ideja ir t\u0101da, ka, ja mar\u0161rut\u0113t\u0101js ir palaidis cauri paketes vien\u0101 sesij\u0101 abos pl\u016bsmu virzienos (TCP sesija ir k\u013cuvusi par ESTABLISHED st\u0101vokli), tad nav nepiecie\u0161ams palaist n\u0101kam\u0101s \u0161\u012bs sesijas paketes cauri visiem ugunsm\u016bra noteikumiem, jo visi \u0161ie p\u0101rbaud\u012bjumi galu gal\u0101 t\u0101pat nosl\u0113gsies ar paketes t\u0101l\u0101ku p\u0101rs\u016bt\u012b\u0161anu mar\u0161rut\u0113\u0161an\u0101. Un neb\u016bs pat nepiecie\u0161ams veikt mar\u0161ruta izv\u0113li \u2014 m\u0113s jau zin\u0101m, kur\u0101 saskarn\u0113 un k\u0101dam hostam \u0161\u012bs sesijas ietvaros ir j\u0101nos\u016bta paketes. Paliek tikai saglab\u0101t \u0161o inform\u0101ciju un izmantot to paketes apstr\u0101des agr\u012bnaj\u0101 posm\u0101. Veicot NAT, papildus j\u0101uztur inform\u0101cija par adres\u0113m un portiem, ko p\u0101rv\u0113r\u0161 nf_conntrack modulis. J\u0101, protams, \u0161aj\u0101 gad\u012bjum\u0101 p\u0101rtrauc darboties da\u017e\u0101di politikas noteic\u0113ji un citi inform\u0101cijas statistikas noteikumi iptables, ta\u010du atsevi\u0161\u0137\u0101 NAT, piem\u0113ram, robe\u017esarg\u0101\u0161anas uzdevumos, tas nav tik b\u016btiski, jo pakalpojumi ir sadal\u012bti pa ier\u012bc\u0113m.<\/p>\n<h4>Konfigur\u0101cija<\/h4>\n<p>\nLai izmantotu \u0161o funkciju, mums ir j\u0101:<\/p>\n<ul>\n<li>Izmanto jaunu kodolu. Neskatoties uz to, ka pats funkcionalit\u0101te par\u0101d\u012bj\u0101s jau kodol\u0101 4.16, ilgu laiku t\u0101 bija \u013coti \"neizstr\u0101d\u0101ta\" un regul\u0101ri izsauca kernel panikas. Viss stabiliz\u0113j\u0101s aptuveni 2019. gada decembr\u012b, kad izn\u0101ca LTS kodoli 4.19.90 un 5.4.5.<\/li>\n<li>P\u0101rveidot iptables noteikumus nftables form\u0101t\u0101, izmantojot pietiekami jaunu nftables versiju. Darbojas prec\u012bzi 0.9.0 versij\u0101.<\/li>\n<\/ul>\n<p>\nJa ar pirmo punktu viss princip\u0101 ir skaidrs, galvenais ir neaizmirst iek\u013caut moduli konfigur\u0101cij\u0101, veidojot (CONFIG_NFT_FLOW_OFFLOAD=m), tad otrais punkts prasa paskaidrojumu. Nftables noteikumi netiek aprakst\u012bti t\u0101pat k\u0101 iptables. <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Main_Page\">Dokument\u0101cija<\/a><\/noindex> atkl\u0101j praktiski visus aspektus, ir ar\u012b speci\u0101lie <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Moving_from_iptables_to_nftables\">p\u0101rv\u0113rst\u0101ji<\/a><\/noindex> noteikumiem no iptables uz nftables. T\u0101d\u0113\u013c es snieg\u0161u tikai NAT un flow offload iestat\u012bjuma piem\u0113ru. Neliela le\u0123enda piem\u0113ram: &lt;i_if&gt;, &lt;o_if&gt; \u2014 ir t\u012bkla interfeisi, caur kuriem pl\u016bst satiksme, to var b\u016bt vair\u0101k nek\u0101 divi. &lt;pool_addr_start&gt;, &lt;pool_addr_end&gt; \u2014 ir s\u0101kuma un beigu adrese \u201ebalto\u201d adresu diapazon\u0101.<\/p>\n<p>NAT konfigur\u0101cija ir \u013coti vienk\u0101r\u0161a:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable nat {\n        chain postrouting {\n                type nat hook postrouting priority 100;\n                oif &lt;o_if&gt; snat to &lt;pool_addr_start&gt;-&lt;pool_addr_end&gt; persistent\n        }\n}\n<\/code><\/pre>\n<p>\nAr flow offload ir nedaudz sare\u017e\u0123\u012bt\u0101k, bet piln\u012bgi saprotami:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable inet filter {\n        flowtable fastnat {\n                hook ingress priority 0\n                devices = { &lt;i_if&gt;, &lt;o_if&gt; }\n        }\n\n        chain forward {\n                type filter hook forward priority 0; policy accept;\n                ip protocol { tcp , udp } flow offload @fastnat;\n        }\n}\n<\/code><\/pre>\n<p>\nL\u016bk, \u012bsum\u0101, visa iestat\u012b\u0161ana. Tagad visa TCP\/UDP satiksme iekrit\u012bs fastnat tabul\u0101 un tiks apstr\u0101d\u0101ta iev\u0113rojami \u0101tr\u0101k.<\/p>\n<h3>Rezult\u0101ti<\/h3>\n<p>\nLai saprastu, cik tas ir \u201eiev\u0113rojami \u0101tr\u0101k\u201d, es pievieno\u0161u ekr\u0101n\u0161\u0101vi\u0146u par slodzi uz diviem re\u0101liem serveriem, ar identisku aparat\u016bru (Xeon E5-1650v2), identiski konfigur\u0113tiem, izmantojot to pa\u0161u Linux kodolu, bet veicot NAT ar iptables (NAT4) un nftables (NAT5).<\/p>\n<p><img decoding=\"async\" alt=\"\u0100tra mar\u0161rut\u0113\u0161ana un NAT Linux\" src=\"\/wp-content\/uploads\/2020\/05\/94bd3f58bf499ceb9837cd771cc9ef9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEkr\u0101n\u0161\u0101vi\u0146\u0101 nav pakot\u0146u sekund\u0113 grafika, bet \u0161o serveru slodzes profil\u0101 vid\u0113j\u0101 pakotnes izm\u0113rs ir ap 800 baitiem, t\u0101p\u0113c v\u0113rt\u012bbas sasniedz 1.5Mpps. K\u0101 redzams, serverim ar nftables ir milz\u012bgs veiktsp\u0113jas rezerv\u0101ts. \u0160obr\u012bd \u0161is serveris apstr\u0101d\u0101 l\u012bdz 30Gbit\/s pie 3Mpps un skaidri sp\u0113j sasniegt fizisko t\u012bkla ierobe\u017eojumu 40Gbps, saglab\u0101jot br\u012bvas CPU resursus.<\/p>\n<p>Ceru, ka \u0161is materi\u0101ls b\u016bs noder\u012bgs t\u012bkla in\u017eenieriem, kuri cen\u0161as uzlabot savu serveru veiktsp\u0113ju.<br \/>\n<br \/>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/501234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0100tra mar\u0161rut\u0113\u0161ana un NAT Linux | ProHoster","description":"Izmantojot IPv4 adresu izsme\u013co\u0161anos, daudzi sakaru operatori saskaras ar nepiecie\u0161am\u012bbu organiz\u0113t pieeju saviem klientiem internetam, izmantojot adreses p\u0101rv\u0113r\u0161anu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-11T23:42:43+00:00","article:modified_time":"2020-05-11T23:42:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81265","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:01:23","updated":"2022-09-28 04:47:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/81265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=81265"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/81265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/81266"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=81265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=81265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=81265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}