{"id":81265,"date":"2020-05-12T01:42:43","date_gmt":"2020-05-11T23:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux"},"modified":"2020-05-12T01:42:43","modified_gmt":"2020-05-11T23:42:43","slug":"bystryj-routing-i-nat-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","title":{"rendered":"Hiter usmerjevalnik in NAT v Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Zaradi iz\u010drpavanja naslovov IPv4 se mnogi operaterji soo\u010dajo z nujnostjo organizacije dostopa svojih strank v omre\u017eje z uporabo prevajanja naslovov. V tem \u010dlanku bom opisal, kako lahko dose\u017eete zmogljivost nivoja Carrier Grade NAT na obi\u010dajnih stre\u017enikih.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Nekaj zgodovine<\/h3>\n<p>\nTema iz\u010drpavanja naslovnega prostora IPv4 ni ve\u010d nova. V nekem trenutku so se pri RIPE pojavile \u010dakalne vrste, nato so se pojavile borze, na katerih so trgovali z bloki naslovov in sklepali pogodbe za njihovo najem. Postopoma so operaterji za\u010deli ponujati storitve dostopa do interneta z uporabo prevajanja naslovov in vrat. Nekateri niso uspeli pridobiti dovolj naslovov, da bi vsakemu naro\u010dniku dodelili 'beli' naslov, nekateri pa so za\u010deli var\u010devati in se odrekli nakupu naslovov na sekundarnem trgu. Proizvajalci omre\u017ene opreme so podprli to idejo, saj ta funkcionalnost obi\u010dajno zahteva dodatne raz\u0161iritve ali licence. Na primer, pri Juniperju v seriji usmerjevalnikov MX (razen zadnjih MX104 in MX204) je izvedba NAPT mogo\u010da na lo\u010deni storitveni kartici MS-MIC, pri Cisco ASR1k je potrebna licenca CGN license, pri Cisco ASR9k pa lo\u010den modul A9K-ISM-100 in licenca A9K-CGN-LIC zanj. Na splo\u0161no, ta u\u017eitek stane kar nekaj denarja.<\/p>\n<h3>IPTables<\/h3>\n<p>\nNaloga izvajanja NAT ne zahteva posebnih ra\u010dunalni\u0161kih virov, to nalogo lahko opravljajo procesorji splo\u0161ne rabe, ki jih najdemo na primer v kateremkoli doma\u010dem usmerjevalniku. Na ravni operaterja to nalogo lahko re\u0161imo s pomo\u010djo obi\u010dajnih stre\u017enikov z operacijskim sistemom FreeBSD (ipfw\/pf) ali GNU\/Linux (iptables). FreeBSD ne bomo obravnavali, saj sem se \u017ee dolgo oddaljil od uporabe tega OS, zato se bomo osredoto\u010dili na GNU\/Linux.<\/p>\n<p>Vklop prevajanja naslovov ni te\u017eko. Najprej je treba v iptables zapisati pravilo v tabelo nat:<\/p>\n<pre><code class=\"bash\">iptables -t nat -A POSTROUTING -s 100.64.0.0\/10 -j SNAT --to - --persistent\n<\/code><\/pre>\n<p>\n\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442 \u043c\u043e\u0434\u0443\u043b\u044c nf_conntrack, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0432\u0441\u0435\u043c\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f. \u0422\u0443\u0442 \u0435\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u043e\u043d\u043a\u043e\u0441\u0442\u0435\u0439. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e NAT \u0432 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u0432\u044f\u0437\u0438, \u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u043a\u0440\u0443\u0442\u0438\u0442\u044c timeout&#8217;\u044b, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0441\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0430\u0437\u043c\u0435\u0440 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0439 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u0440\u0430\u0441\u0442\u0435\u0442 \u0434\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439. \u041d\u0438\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u0440 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1\nnet.ipv4.ip_local_port_range = 8192 65535\n\nnet.netfilter.nf_conntrack_generic_timeout = 300\nnet.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60\nnet.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60\nnet.netfilter.nf_conntrack_tcp_timeout_established = 600\nnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60\nnet.netfilter.nf_conntrack_tcp_timeout_close_wait = 45\nnet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30\nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120\nnet.netfilter.nf_conntrack_tcp_timeout_close = 10\nnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300\nnet.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300\nnet.netfilter.nf_conntrack_udp_timeout = 30\nnet.netfilter.nf_conntrack_udp_timeout_stream = 60\nnet.netfilter.nf_conntrack_icmpv6_timeout = 30\nnet.netfilter.nf_conntrack_icmp_timeout = 30\nnet.netfilter.nf_conntrack_events_retry_timeout = 15\nnet.netfilter.nf_conntrack_checksum=0\n<\/code><\/pre>\n<p>\nIn drugi\u010d, ker velikost tabele prevodov ob privzeto ni zasnovana za delovanje v razmerah telekomunikacijskega operaterja, jo je potrebno pove\u010dati:<\/p>\n<pre><code class=\"plaintext\">net.netfilter.nf_conntrack_max = 3145728\n<\/code><\/pre>\n<p>\n Prav tako je treba pove\u010dati \u0161tevilo buckets za hashtable, ki hrani vse prevede (to je opcija modula nf_conntrack): <\/p>\n<pre><code class=\"plaintext\">options nf_conntrack hashsize=1572864\n<\/code><\/pre>\n<p>\nPo teh enostavnih manipulacijah dobimo povsem delujo\u010do konstrukcijo, ki lahko prevaja veliko \u0161tevilo odjemalskih naslovov v zunanji bazen. Vendar pa zmogljivost te re\u0161itve pu\u0161\u010da \u017eeljo. V svojih prvih poskusih uporabe GNU\/Linux za NAT (pribli\u017eno 2013) sem uspel dose\u010di zmogljivost okoli 7 Gbit\/s pri 0.8 Mpps na en stre\u017enik (Xeon E5-1650v2). Od takrat je bilo v omre\u017enem kupu jedra GNU\/Linux narejenih veliko razli\u010dnih optimizacij, zmogljivost enega stre\u017enika na istem hardveru je zrasla skoraj do 18-19 Gbit\/s pri 1.8-1.9 Mpps (to so bili mejni podatki), toda potreba po obsegu prometa, obdelanega z enim stre\u017enikom, je rasla precej hitreje. Na koncu so bile razvite sheme za obvladovanje obremenitve na razli\u010dne stre\u017enike, kar pa je pove\u010dalo kompleksnost nastavitve, vzdr\u017eevanja in zagotavljanja kakovosti ponujenih storitev.<\/p>\n<h3>NFTables<\/h3>\n<p>\nTrenutno je popularno kori\u0161\u0107enje DPDK-a i XDP-a u programskom \u201epreme\u0161tanju paketa\u201c. O ovoj temi je napisana mno\u0161tvo \u010dlanaka, odr\u017eano je mnogo razli\u010ditih prezentacija, a pojavili su se i komercijalni proizvodi (na primer, SKAT od VasExperts). Me\u0111utim, u uslovima ograni\u010denih resursa programera kod telekomunikacionih operatera, te\u0161ko je samostalno razvijati neka \u201ere\u0161enja\u201c na bazi ovih okvira. Dalja upotreba takvih re\u0161enja \u0107e biti znatno slo\u017eenija, posebno \u0107e biti neophodno razvijati alate za dijagnostiku. Na primer, standardni tcpdump sa DPDK-om jednostavno ne\u0107e raditi, a ni paketi poslati nazad putem XDP-a ne\u0107e biti \u201evi\u0111eni\u201c. I dok se svi razgovori vrte oko novih tehnologija preusmeravanja paketa u korisni\u010dkom re\u017eimu, ostalo je neprime\u0107eno <noindex><a rel=\"nofollow\" href=\"https:\/\/netdevconf.info\/0x13\/session.html?workshop-netfilter-mini\">izvje\u0161taji<\/a><\/noindex> in <noindex><a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/738214\/\">\u010dlanka<\/a><\/noindex> Pablo Neira Ayuso, odr\u017eava\u010d iptables-a, o razvoju flow offloading-a u nftables-u. Hajde da ovo razmotrimo detaljnije.<\/p>\n<p>Osnovna ideja je da, ako usmeriva\u010d propu\u0161ta pakete jedne sesije u oba pravca toka (TCP sesija je pre\u0161la u stanje ESTABLISHED), nema potrebe da se naredni paketi te sesije propu\u0161taju kroz sve firewall pravila, jer \u0107e sve ove provere ionako zavr\u0161iti prosledjivanjem paketa dalje u rutiranje. Ni izbor rute vi\u0161e nije potreban \u2013 ve\u0107 znamo na koji interfejs i kojem hostu treba proslediti pakete unutar te sesije. Ostaje samo da se sa\u010duva ta informacija i iskoristi je za rutiranje u ranoj fazi obrade paketa. Tokom NAT-a, tako\u0111e je potrebno sa\u010duvati informacije o promenama adresa i portova koje je izmenio modul nf_conntrack. Da, naravno, u ovom slu\u010daju prestaju da rade razli\u010diti policeri i druga informativno-statisti\u010dka pravila u iptables-u, ali u okviru zadatka zasebnog NAT-a ili, na primer, bordera \u2013 to nije tako va\u017eno, jer su usluge raspore\u0111ene po ure\u0111ajima.<\/p>\n<h4>\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f<\/h4>\n<p>\nDa bismo iskoristili ovu funkciju, potrebno je:<\/p>\n<ul>\n<li>Koristiti sve\u017eu verziju jezgra. Iako je sama funkcija prvobitno uvedena u jezgru 4.16, dugo vremena je bila izrazito \u201esirova\u201c i redovno je izazivala kernel panic. Stabilizovana je otprilike u decembru 2019. godine, kada su objavljena LTS jezgra 4.19.90 i 5.4.5.<\/li>\n<li>Preurediti pravila iptables u nftables format, koriste\u0107i dovoljno svje\u017eu verziju nftables. Radi sigurno u verziji 0.9.0<\/li>\n<\/ul>\n<p>\nAko je prvi deo u su\u0161tini jasan, najva\u017enije je ne zaboraviti uklju\u010diti modul u konfiguraciju pri kompilaciji (CONFIG_NFT_FLOW_OFFLOAD=m), drugi deo zahteva obja\u0161njenje. Pravila nftables opisuju se potpuno druga\u010dije nego u iptables. <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Main_Page\">Dokumentacija<\/a><\/noindex> pokre\u0107e gotovo sve aspekte, tako\u0111e postoje posebni <noindex><a rel=\"nofollow\" href=\"https:\/\/wiki.nftables.org\/wiki-nftables\/index.php\/Moving_from_iptables_to_nftables\">konvertori<\/a><\/noindex> pravila iz iptables u nftables. Stoga \u0107u dati samo primer pode\u0161avanja NAT-a i flow offload-a. Kratak okvir za primer: <i>,  \u2014 to su mre\u017eni interfejsi preko kojih prolazi saobra\u0107aj, stvarno ih mo\u017ee biti vi\u0161e od dva. , \u2014 po\u010detna i krajnja adresa opsega \"belih\" adresa.<\/p>\n<p>Konfiguracija NAT-a je vrlo jednostavna:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable nat {\n        chain postrouting {\n                type nat hook postrouting priority 100;\n                oif &lt;o_if&gt; snat to &lt;pool_addr_start&gt;-&lt;pool_addr_end&gt; persistent\n        }\n}\n<\/code><\/pre>\n<p>\nSa flow offload-om je malo slo\u017eenije, ali potpuno razumljivo:<\/p>\n<pre><code class=\"bash\">#! \/usr\/sbin\/nft -f\n\ntable inet filter {\n        flowtable fastnat {\n                hook ingress priority 0\n                devices = { &lt;i_if&gt;, &lt;o_if&gt; }\n        }\n\n        chain forward {\n                type filter hook forward priority 0; policy accept;\n                ip protocol { tcp , udp } flow offload @fastnat;\n        }\n}\n<\/code><\/pre>\n<p>\nEto, to je cela konfiguracija. Sada \u0107e sav TCP\/UDP saobra\u0107aj ulaziti u tabelu fastnat i biti obra\u0111en mnogo br\u017ee.<\/p>\n<h3>Rezultati<\/h3>\n<p>\nDa bi postalo jasno koliko je ovo \"mnogo br\u017ee\", prilo\u017ei\u0107u screenshot optere\u0107enja dva stvarna servera, sa istom opremom (Xeon E5-1650v2), isto pode\u0161enih, koriste\u0107i istu Linux jezgru, ali obavljaju\u0107i NAT u iptables (NAT4) i u nftables (NAT5).<\/p>\n<p><img decoding=\"async\" alt=\"Hiter usmerjevalnik in NAT v Linuxu\" src=\"\/wp-content\/uploads\/2020\/05\/94bd3f58bf499ceb9837cd771cc9ef9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa screenshot-u nema grafika paketa u sekundi, ali u profilu optere\u0107enja ovih servera prose\u010dna veli\u010dina paketa je oko 800 bajtova, tako da se vrednosti penju do 1.5Mpps. Kao \u0161to se mo\u017ee videti, kapacitet servera sa nftables je ogroman. Trenutno ovaj server obra\u0111uje do 30Gbit\/s pri 3Mpps i o\u010digledno je sposoban da dostigne fizi\u010dko ograni\u010denje mre\u017ee od 40Gbps, pri \u010demu su CPU resursi jo\u0161 uvek slobodni.<\/p>\n<p>Nadam se da \u0107e ovaj materijal biti koristan mre\u017enim in\u017eenjerima koji poku\u0161avaju pobolj\u0161ati performanse svojih servera.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/501234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0443\u0440\u043e\u0432\u043d\u044f Carrier Grade NAT \u043d\u0430 commodity \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445. \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0422\u0435\u043c\u0430 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 IPv4 \u0443\u0436\u0435 \u043d\u0435 \u043d\u043e\u0432\u0430. \u0412 \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043c\u043e\u043c\u0435\u043d\u0442 \u0432 RIPE \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-11T23:42:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Brzi routing i NAT u Linuxu | ProHoster","description":"Kako se adrese IPv4 tro\u0161e, mnogi pru\u017eaoci internet usluga suo\u010davaju se s potrebom da organizuju pristup svojim klijentima u mre\u017eu putem prevo\u0111enja adresa.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433 \u0438 NAT \u0432 Linux | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4, \u043c\u043d\u043e\u0433\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0432\u044f\u0437\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0441\u0435\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/bystryj-routing-i-nat-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-11T23:42:43+00:00","article:modified_time":"2020-05-11T23:42:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81265","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:01:23","updated":"2022-09-28 04:47:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/81265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=81265"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/81265\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/81266"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=81265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=81265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=81265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}