{"id":81265,"date":"2020-05-12T01:42:43","date_gmt":"2020-05-11T23:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux"},"modified":"2020-05-12T01:42:43","modified_gmt":"2020-05-11T23:42:43","slug":"bystryj-routing-i-nat-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","title":{"rendered":"R\u00fdchle smerovanie a NAT v Linuxe","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>S narastaj\u00facim nedostatkom adries IPv4 \u010del\u00ed mnoho poskytovate\u013eov slu\u017eieb nutnosti organizova\u0165 pr\u00edstup svojich klientov do siete pomocou prekladania adries. V tomto \u010dl\u00e1nku v\u00e1m uk\u00e1\u017eem, ako dosiahnu\u0165 \u00farove\u0148 v\u00fdkonu Carrier Grade NAT na komoditn\u00fdch serveroch.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Trochu hist\u00f3rie<\/h3>\n<p>\nT\u00e9ma vy\u010derpania adresn\u00e9ho priestoru IPv4 u\u017e nie je novinkou. V ur\u010ditom momente sa v RIPE objavili \u010dakacie zoznamy, n\u00e1sledne vznikli burzy, na ktor\u00fdch sa obchodovalo s blokmi adries a uzatv\u00e1rali sa dohody o ich pren\u00e1jme. Postupne za\u010dali poskytovatelia slu\u017eieb pon\u00faka\u0165 pr\u00edstup do internetu prostredn\u00edctvom prekladania adries a portov. Niektor\u00ed nestihli z\u00edska\u0165 dostatok adries, aby mohli ka\u017ed\u00e9mu odberate\u013eovi priradi\u0165 \"bielu\" adresu, a in\u00ed za\u010dali \u0161etri\u0165 a odmietli n\u00e1kup adries na sekund\u00e1rnom trhu. V\u00fdrobcovia sie\u0165ov\u00fdch zariaden\u00ed podporili t\u00fato my\u0161lienku, preto\u017ee t\u00e1to funk\u010dnos\u0165 zvy\u010dajne vy\u017eaduje dodato\u010dn\u00e9 roz\u0161\u00edrenia alebo licencie. Napr\u00edklad, spolo\u010dnos\u0165 Juniper vo svojej l\u00ednii smerova\u010dov MX (okrem posledn\u00fdch modelov MX104 a MX204) umo\u017e\u0148uje vykon\u00e1va\u0165 NAPT na samostatnej servisnej karte MS-MIC, na Cisco ASR1k je potrebn\u00e1 licencia CGN license, na Cisco ASR9k - samostatn\u00fd modul A9K-ISM-100 a licencia A9K-CGN-LIC k nemu. Celkovo, t\u00e1to slu\u017eba nie je lacn\u00e1.<\/p>\n<h3>IPTables<\/h3>\n<p>\n\u00daloha vykon\u00e1va\u0165 NAT nevy\u017eaduje \u0161pecializovan\u00e9 v\u00fdpo\u010dtov\u00e9 zdroje, m\u00f4\u017ee ju vyrie\u0161i\u0165 ak\u00fdko\u013evek procesor ur\u010den\u00fd na v\u0161eobecn\u00e9 \u00fa\u010dely, ktor\u00fd je nain\u0161talovan\u00fd napr\u00edklad v dom\u00e1com routeri. Na \u00farovni poskytovate\u013ea slu\u017eieb mo\u017eno t\u00fato \u00falohu vyrie\u0161i\u0165 pomocou komoditn\u00fdch serverov zalo\u017een\u00fdch na FreeBSD (ipfw\/pf) alebo GNU\/Linux (iptables). FreeBSD nebudeme bra\u0165 do \u00favahy, ke\u010f\u017ee som sa tejto opera\u010dnej s\u00fastavy u\u017e d\u00e1vno vzdal, a tak sa zameriame na GNU\/Linux.<\/p>\n<p>Povoli\u0165 preklad adries nie je v\u00f4bec zlo\u017eit\u00e9. Najsk\u00f4r je potrebn\u00e9 prida\u0165 pravidlo do iptables do tabu\u013eky nat:<\/p>\n<pre><code class=\"bash\">iptables -t nat -A POSTROUTING -s 100.64.0.0\/10 -j SNAT --to - --persistent\n<\/code><\/pre>\n<p>\nOpera\u010dn\u00fd syst\u00e9m na\u010d\u00edta modul nf_conntrack, ktor\u00fd bude sledova\u0165 v\u0161etky akt\u00edvne pripojenia a vykon\u00e1va\u0165 potrebn\u00e9 transform\u00e1cie. Existuje nieko\u013eko nu\u00e1ns. Po prv\u00e9, ke\u010f\u017ee ide o NAT v rozsahu telekomunika\u010dn\u00e9ho oper\u00e1tora, je potrebn\u00e9 upravi\u0165 timeouty, preto\u017ee s predvolen\u00fdmi hodnotami sa ve\u013ekos\u0165 prekladovej tabu\u013eky dostato\u010dne r\u00fdchlo zv\u00fd\u0161i na katastrofick\u00e9 hodnoty. Ni\u017e\u0161ie je pr\u00edklad nastaven\u00ed, ktor\u00e9 som pou\u017eil na svojich serveroch:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1\nnet.ipv4.ip_local_port_range = 8192 65535\n\nnet.netfilter.nf_conntrack_generic_timeout = 300\nnet.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60\nnet.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60\nnet.netfilter.nf_conntrack_tcp_timeout_established = 600\nnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60\nnet.netfilter.nf_conntrack_tcp_timeout_close_wait = 45\nnet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30\nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120\nnet.netfilter.nf_conntrack_tcp_timeout_close = 10\nnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300\nnet.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300\nnet.netfilter.nf_conntrack_udp_timeout = 30\nnet.netfilter.nf_conntrack_udp_timeout_stream = 60\nnet.netfilter.nf_conntrack_icmpv6_timeout = 30\nnet.netfilter.nf_conntrack_icmp_timeout = 30\nnet.netfilter.nf_conntrack_events_retry_timeout = 15\nnet.netfilter.nf_conntrack_checksum=0\n<\/code><\/pre>\n<p>\nA po druh\u00e9, ke\u010f\u017ee predvolen\u00e1 ve\u013ekos\u0165 prekladovej tabu\u013eky nie je prisp\u00f4soben\u00e1 na pr\u00e1cu na \u00farovni poskytovate\u013ea slu\u017eieb, je potrebn\u00e9 ju zv\u00fd\u0161i\u0165:<\/p>\n<pre><code class=\"plaintext\">net.netfilter.nf_conntrack_max = 3145728\n<\/code><\/pre>\n<p>\n Taktie\u017e je potrebn\u00e9 zv\u00fd\u0161i\u0165 po\u010det buckets pre hashovaciu tabu\u013eku, ktor\u00e1 uchov\u00e1va v\u0161etky preklady (t\u00e1to vo\u013eba patr\u00ed k modulu nf_conntrack): <\/p>\n<pre><code class=\"plaintext\">options nf_conntrack hashsize=1572864\n<\/code><\/pre>\n<p>\nPo t\u00fdchto jednoduch\u00fdch manipul\u00e1ci\u00e1ch m\u00e1me plne funk\u010dn\u00fa kon\u0161trukciu, ktor\u00e1 dok\u00e1\u017ee preklada\u0165 ve\u013ek\u00e9 mno\u017estvo klientskych adries do fondu vonkaj\u0161\u00edch adries. Av\u0161ak v\u00fdkon tohto rie\u0161enia zost\u00e1va \u017eelan\u00fd. V svojich prv\u00fdch pokusoch o vyu\u017e\u00edvanie GNU\/Linux pre NAT (pribli\u017ene v roku 2013) som dok\u00e1zal dosiahnu\u0165 v\u00fdkon pribli\u017ene 7 Gbit\/s pri 0.8 Mpps na jeden server (Xeon E5-1650v2). Odvtedy bolo v sie\u0165ovom stacku jadra GNU\/Linux vykonan\u00fdch ve\u013ea r\u00f4znych optimaliz\u00e1ci\u00ed, v\u00fdkon jedn\u00e9ho servera na tom istom hardv\u00e9ri sa zv\u00fd\u0161il takmer na 18-19 Gbit\/s pri 1.8-1.9 Mpps (to boli maxim\u00e1lne hodnoty), ale potreba na objem prev\u00e1dzky spracov\u00e1vanej jedn\u00fdm serverom r\u00e1stla omnoho r\u00fdchlej\u0161ie. Nakoniec boli vyvinut\u00e9 sch\u00e9my rozde\u013eovania z\u00e1\u0165a\u017ee medzi r\u00f4zne servery, ale v\u0161etko toto zv\u00fd\u0161ilo zlo\u017eitosti nastaven\u00ed, \u00fadr\u017eby a zachovania kvality poskytovan\u00fdch slu\u017eieb.<\/p>\n<h3>NFTables<\/h3>\n<p>\nV s\u00fa\u010dasnosti je m\u00f3dnym trendom v programovom \"pres\u00favan\u00ed paketov\" pou\u017e\u00edvanie DPDK a XDP. Na t\u00fato t\u00e9mu bolo nap\u00edsan\u00fdch mno\u017estvo \u010dl\u00e1nkov, uskuto\u010dnilo sa ve\u013ea r\u00f4znych prezent\u00e1ci\u00ed a vznikaj\u00fa komer\u010dn\u00e9 produkty (napr\u00edklad SKAT od VasExperts). Ale v podmienkach obmedzen\u00fdch zdrojov program\u00e1torov u oper\u00e1torov telekomunika\u010dn\u00fdch slu\u017eieb je dos\u0165 problematick\u00e9 vytvori\u0165 si vlastn\u00e9 \"dielo\" na z\u00e1klade t\u00fdchto r\u00e1mcov. Prev\u00e1dzkovanie tak\u00e9ho rie\u0161enia bude nielen n\u00e1ro\u010dnej\u0161ie, ale bude potrebn\u00e9 aj vyv\u00edja\u0165 diagnostick\u00e9 n\u00e1stroje. Napr\u00edklad \u0161tandardn\u00fd tcpdump s DPDK len tak nefunguje a ani pakety poslan\u00e9 sp\u00e4\u0165 do vodi\u010dov pomocou XDP nebud\u00fa \"vidite\u013en\u00e9\". Na pozad\u00ed v\u0161etk\u00fdch diskusi\u00ed o nov\u00fdch technol\u00f3gi\u00e1ch pos\u00favania paketov do user-space zostali bez pov\u0161imnutia <noindex><a rel=\"nofollow\" href=\"https:\/\/netdevconf.info\/0x13\/session.html?workshop-netfilter-mini\">prezent\u00e1cie<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/738214\/\">\u010dl\u00e1nku<\/a><\/noindex> Pablo Neira Ayuso, \u00fadr\u017eb\u00e1r iptables, o v\u00fdvoji flow offloading v nftables. Pozrime sa na tento mechanizmus podrobnej\u0161ie.<\/p>\n<p>Hlavn\u00e1 my\u0161lienka spo\u010d\u00edva v tom, \u017ee ak router prepustil pakety jednej rel\u00e1cie v oboch smeroch toku (TCP rel\u00e1cia pre\u0161la do stavu ESTABLISHED), nie je potrebn\u00e9 prep\u00fa\u0161\u0165a\u0165 \u010fal\u0161ie pakety tejto rel\u00e1cie cez v\u0161etky pravidl\u00e1 firewallu, preto\u017ee v\u0161etky tieto kontroly sa aj tak skon\u010dia odovzdan\u00edm paketu \u010falej do routovania. A vlastne nie je potrebn\u00e9 vykon\u00e1va\u0165 v\u00fdber trasy \u2014 u\u017e vieme, do ktor\u00e9ho rozhrania a ktor\u00e9mu hostite\u013eovi je potrebn\u00e9 doru\u010di\u0165 pakety v r\u00e1mci tejto rel\u00e1cie. Sta\u010d\u00ed si t\u00fato inform\u00e1ciu uchova\u0165 a vyu\u017ei\u0165 ju na smerovanie v po\u010diato\u010dnej f\u00e1ze spracovania paketu. Pri vykon\u00e1van\u00ed NAT je potrebn\u00e9 navy\u0161e uchova\u0165 inform\u00e1cie o zmen\u00e1ch adries a portov, ktor\u00e9 boli transformovan\u00e9 modulom nf_conntrack. V skuto\u010dnosti prestan\u00fa fungova\u0165 r\u00f4zne politiky a in\u00e9 informa\u010dno-\u0161tatistick\u00e9 pravidl\u00e1 v iptables, ale v r\u00e1mci \u00falohy oddelen\u00e9ho stojaceho NAT alebo napr\u00edklad hrani\u010dn\u00e9ho - to nie je tak d\u00f4le\u017eit\u00e9, preto\u017ee slu\u017eby s\u00fa rozdelen\u00e9 medzi zariadeniami.<\/p>\n<h4>Konfigur\u00e1cia<\/h4>\n<p>\nAby sme mohli vyu\u017ei\u0165 t\u00fato funkciu, mus\u00edme:<\/p>\n<ul>\n<li>Pou\u017ei\u0165 najnov\u0161ie jadro. Napriek tomu, \u017ee funkcia sa objavila u\u017e v jadre 4.16, bola dlh\u00fd \u010das ve\u013emi \"nedokon\u010den\u00e1\" a pravidelne sp\u00f4sobovala kernel panic. Stabilizovalo sa to pribli\u017ene v decembri 2019, ke\u010f vy\u0161li LTS jadr\u00e1 4.19.90 a 5.4.5.<\/li>\n<li>Prepisovanie pravidiel iptables do form\u00e1tu nftables, s pou\u017eit\u00edm dostato\u010dne aktu\u00e1lnej verzie nftables. Presne funguje vo verzii 0.9.0<\/li>\n<\/ul>\n<p>\nAk je prv\u00fd bod v z\u00e1sade jasn\u00fd, hlavn\u00fdm je nezabudn\u00fa\u0165 zapn\u00fa\u0165 modul v konfigur\u00e1cii pri zostavovan\u00ed (CONFIG_NFT_FLOW_OFFLOAD=m), druh\u00fd bod si v\u0161ak vy\u017eaduje vysvetlenie. Pravidl\u00e1 nftables sa opisuj\u00fa \u00faplne inak ako v iptables. <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Main_Page\">Dokument\u00e1cia<\/a><\/noindex> odkr\u00fdva prakticky v\u0161etky aspekty, s\u00fa tu aj \u0161peci\u00e1lne <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Moving_from_iptables_to_nftables\">konvertory<\/a><\/noindex> pravidiel z iptables do nftables. Preto uvediem len pr\u00edklad nastavenia NAT a flow offload. Mal\u00e1 legenda pre pr\u00edklad: <i>,  \u2014 to s\u00fa sie\u0165ov\u00e9 rozhrania, cez ktor\u00e9 prech\u00e1dza prev\u00e1dzka, v skuto\u010dnosti ich m\u00f4\u017ee by\u0165 viac ako dve. ,  \u2014 po\u010diato\u010dn\u00e1 a kone\u010dn\u00e1 adresa rozsahu \u201ebielych\u201c adries.<\/p>\n<p>Konfigur\u00e1cia NAT je ve\u013emi jednoduch\u00e1:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable nat {\n        chain postrouting {\n                type nat hook postrouting priority 100;\n                oif &lt;o_if&gt; snat to &lt;pool_addr_start&gt;-&lt;pool_addr_end&gt; persistent\n        }\n}\n<\/code><\/pre>\n<p>\nS flow offload je to o nie\u010do zlo\u017eitej\u0161ie, ale celkom jasn\u00e9:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable inet filter {\n        flowtable fastnat {\n                hook ingress priority 0\n                devices = { &lt;i_if&gt;, &lt;o_if&gt; }\n        }\n\n        chain forward {\n                type filter hook forward priority 0; policy accept;\n                ip protocol { tcp , udp } flow offload @fastnat;\n        }\n}\n<\/code><\/pre>\n<p>\nA to je vlastne cel\u00e9 nastavenie. Teraz cel\u00fd TCP\/UDP prev\u00e1dzka p\u00f4jde do tabu\u013eky fastnat a bude spracov\u00e1van\u00e1 ove\u013ea r\u00fdchlej\u0161ie.<\/p>\n<h3>V\u00fdsledky<\/h3>\n<p>\nAby bolo jasn\u00e9, ako ve\u013emi r\u00fdchlej\u0161ie, prilo\u017e\u00edm sn\u00edmku za\u0165a\u017eenia dvoch skuto\u010dn\u00fdch serverov, s rovnak\u00fdm vybaven\u00edm (Xeon E5-1650v2), rovnako nastaven\u00fdch, pou\u017e\u00edvaj\u00facich to ist\u00e9 jadro Linuxu, ale vykon\u00e1vaj\u00facich NAT v iptables (NAT4) a v nftables (NAT5).<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fdchle smerovanie a NAT v Linuxe\" src=\"\/wp-content\/uploads\/2020\/05\/94bd3f58bf499ceb9837cd771cc9ef9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa sn\u00edmke nie je graf paketov za sekundu, ale v profile za\u0165a\u017eenia t\u00fdchto serverov je priemern\u00e1 ve\u013ekos\u0165 paketu okolo 800 bajtov, preto hodnoty dosahuj\u00fa a\u017e 1.5Mpps. Ako je vidie\u0165, rezerva v\u00fdkonu na serveri s nftables je obrovsk\u00e1. V s\u00fa\u010dasnosti tento server spracov\u00e1va a\u017e 30Gbit\/s pri 3Mpps a je jasne schopn\u00fd narazi\u0165 na fyzick\u00e9 obmedzenie siete 40Gbps, pri\u010dom m\u00e1 vo\u013en\u00e9 CPU zdroje.<\/p>\n<p>D\u00fafam, \u017ee tento materi\u00e1l bude u\u017eito\u010dn\u00fd sie\u0165ov\u00fdm in\u017einierom sna\u017eiacim sa zlep\u0161i\u0165 v\u00fdkon svojich serverov.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/501234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fdchle smerovanie a NAT v Linuxe | ProHoster","description":"S postupn\u00fdm vy\u010derp\u00e1van\u00edm adries IPv4 sa mnoh\u00ed poskytovatelia slu\u017eieb stretli s potrebou organizova\u0165 pr\u00edstup svojich klientov do siete pomocou prekladania adries.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-11T23:42:43+00:00","article:modified_time":"2020-05-11T23:42:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81265","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:01:23","updated":"2022-09-28 04:47:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/81265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=81265"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/81265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/81266"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=81265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=81265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=81265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}