ืืื IPv4 ืึทืืจืขืกืขืก ืืืขืจื ืืืคึผืืืืื, ืคืืืข ืืขืืขืงืึธื ืึธืคึผืขืจืืืืขืจื ืืขื ืขื ืคืืืกื ืืื ืื ื ืืื ืฆื ืฆืืฉืืขืื ืืืืขืจ ืงืืืืึทื ืฅ ื ืขืฅ ืึทืงืกืขืก ื ืืฆื ืึทืืจืขืก ืืืืขืจืืขืฆืื ื. ืืื ืืขื ืึทืจืืืงื ืืื ืืืขื ืืึธืื ืืืจ ืืื ืืืจ ืงืขื ืขื ืืึทืงืืืขื ืงืึทืจืืขืจ ืืจืึทืืข NAT ืคืึธืจืฉืืขืืื ื ืืืืฃ ืกืืืืจืข ืกืขืจืืืขืจืก.
ื ืืืกื ืคืื ืืขืฉืืืืข
ืื ืืขืืข ืคืื โโIPv4 ืึทืืจืขืก ืคึผืืึทืฅ ืืืืึธืกืืฉืึทื ืืื ื ืื ืืขืจ ื ืืึท. ืืื ืขืืืขืืข ืคืื ื, ืืืืจืื ืจืฉืืืืช ืืจืืืก ืืื RIPE, ืืขืืึธืื ืืงืกืืฉืืื ืืืฉืื ืืืขืจืืืฉื ืืืืฃ ืืืึธืก ืืืึทืงืก ืคืื ืึทืืจืขืกืขืก ืืขื ืขื ืืขืืืขื ืืจืืืืื ืืื ืืืื ืืขื ืขื ืืขืคืื ืขื ืฆื ืืื ืืขื ืืื. ืืืกืืขืืืืืึทื, ืืขืืขืงืึธื ืึธืคึผืขืจืืืืขืจื ืื ืืขืืืืื ืฆื ืฆืืฉืืขืื ืืื ืืขืจื ืขื ืึทืงืกืขืก ืืึทืืื ืื ืืก ื ืืฆื ืึทืืจืขืก ืืื ืคึผืึธืจื ืืืืขืจืืขืฆืื ื. ืขืืืขืืข ืืึธืื ื ืื ืืขืจืืื ืฆื ืืึทืงืืืขื ืืขื ืื ืึทืืจืขืกืขืก ืฆื ืึทืจืืืกืืขืื ืึท "ืืืืึทืก" ืึทืืจืขืก ืฆื ืืขืืขืจ ืึทืืึธื ืขื ื, ืืฉืขืช ืื ืืขืจืข ืื ืืขืืืืื ืฆื ืฉืคึผืึธืจื ืืขืื ืืืจื ืึธืคึผืืึธืื ืฆื ืงืืืคื ืึทืืจืขืกืขืก ืืืืฃ ืื ืฆืืืืืืืง ืืึทืจืง. ืืึทื ืืึทืคืึทืงืืฉืขืจืขืจื ืคืื ื ืขืฅ ืืืกืจืืื ืืขืฉืืืฆื ืืขื ืืขืืึทื ืง, ืืืืึทื ืืขื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืืืฉืึทืืืึทืื ืจืืงืืืืืขืจื ื ืึธื ืืขืฉืคึผืจืืื ืืึทืืืฉืืื ืึธืืขืจ ืืืืกืึทื ืกืื. ืืืฉื, ืืื ืืืฉืื ืืคึผืขืจ ืก ืฉืืจื ืคืื ืืงืก ืจืึธืืืขืจืก (ืึทืืืฅ ืคึฟืึทืจ ืื ืืขืฆืืข MX104 ืืื MX204), ืืืจ ืงืขื ืขื ืืืจืืคืืจื NAPT ืืืืฃ ืึท ืืึทืืื ืืขืจ MS-MIC ืืื ืกื ืงืึธืจื, Cisco ASR1k ืจืืงืืืืืขืจื ืึท CGN ืืขืจืืืืืขื ืืฉ, Cisco ASR9k ืจืืงืืืืืขืจื ืึท ืืึทืืื ืืขืจ A9K-ISM-100 ืืึธืืืืข. ืืื ืึท A9K-CGN ืืขืจืืืืืขื ืืฉ -LIC ืฆื ืืื. ืืื ืึทืืืขืืืื, ืื ืคืึทืจืืขื ืืื ืงืึธืก ืึท ืคึผืืึทืฅ ืคืื ืืขืื.
IPTables
ืื ืึทืจืืขื ืคืื ืคึผืขืจืคืึธืจืืื ื NAT ืืื ื ืืฉื ืืึทืจืคื ืกืคึผืขืฉืึทืืืืื ืงืึทืืคึผืืืืื ื ืจืขืกืืจืกื; ืขืก ืงืขื ืขื ืืืื ืกืึทืืืื ืืืจื ืืขื ืขืจืึทื-ืฆืื ืคึผืจืึทืกืขืกืขืจื ืืืึธืก ืืขื ืขื ืืื ืกืืึทืืืจื, ืืืฉื, ืืื ืงืืื ืืืื ืจืึทืืืขืจ. ืืืืฃ ืื ืืืึธื ืคืื ืึท ืืขืืขืงืึธื ืึธืคึผืขืจืึทืืึธืจ, ืืขื ืคึผืจืึธืืืขื ืงืขื ืขื ืืืื ืกืึทืืืื ื ืืฆื ืกืืืืจืข ืกืขืจืืืขืจืก ืืื FreeBSD (ipfw/pf) ืึธืืขืจ GNU/Linux (iptables). ืืืจ ืืืขืื ื ืืฉื ืืึทืืจืึทืืื FreeBSD, ืืืืึทื ... ืืื ืคืืจืฉืืืคื ื ืืฆื ืืขื ืึทืก ืืึทื ืฅ ืึท ืืึทื ื ืฆืืึทื ืฆืืจืืง, ืึทืืื ืืืจ ืืืขืื ืฉืืขืงื ืฆื GNU / ืืื ืืงืก.
ืขื ืืืืึทืืื ื ืึทืืจืขืก ืืืืขืจืืขืฆืื ื ืืื ื ืืฉื ืฉืืืขืจ. ืขืจืฉืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืจืขืืืกืืจืืจื ืึท ืืขืจืฉื ืืื iptables ืืื ืื ื ืึทื ืืืฉ:
iptables -t nat -A POSTROUTING -s 100.64.0.0/10 -j SNAT --to <pool_start_addr>-<pool_end_addr> --persistent
ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืืืขื ืืึธืื ืื nf_conntrack ืืึธืืืืข, ืืืึธืก ืืืขื ืืึธื ืืืึธืจ ืึทืืข ืึทืงืืืื ืงืึทื ืขืงืฉืึทื ื ืืื ืืืจืืคืืจื ืื ื ืืืืืง ืงืึทื ืืืขืจืืฉืึทื ื. ืขืก ืืขื ืขื ืขืืืขืืข ืกืึทืืึทืืืื ืืึธ. ืขืจืฉืืขืจ, ืืื ื ืืืจ ืืขื ืขื ืืขืจืขืื ืืืขืื NAT ืืืืฃ ืื ืืืึธื ืคืื ืึท ืืขืืขืงืึธื ืึธืคึผืขืจืึทืืึธืจ, ืขืก ืืื ื ืืืืืง ืฆื ืกืืจืืืขืจื ืื ืืืืืึทืืฅ, ืืืืึทื ืืื ืคืขืืืงืืึทื ืืืึทืืืขืก ืื ืืจืืืก ืคืื ืื ืืืืขืจืืขืฆืื ื ืืืฉ ืืืขื ืืขืฉืืืื ื ืืืึทืงืกื ืฆื ืงืึทืืึทืกืืจืึธืคืืง ืืืึทืืืขืก. ืื ืืขืจ ืืื ืึท ืืืืฉืคึผืื ืคืื ืื ืกืขืืืื ืืก ืืื ืืขืืืืื ื ืืืืฃ ืืืื ืกืขืจืืืขืจืก:
net.ipv4.ip_forward = 1
net.ipv4.ip_local_port_range = 8192 65535
net.netfilter.nf_conntrack_generic_timeout = 300
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 60
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 45
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60
net.netfilter.nf_conntrack_icmpv6_timeout = 30
net.netfilter.nf_conntrack_icmp_timeout = 30
net.netfilter.nf_conntrack_events_retry_timeout = 15
net.netfilter.nf_conntrack_checksum=0
ืืื ืฆืืืืืื ืก, ืืื ื ืื ืคืขืืืงืืึทื ืืจืืืก ืคืื ืื ืืืืขืจืืขืฆืื ื ืืืฉ ืืื ื ืืฉื ืืืืืื ื ืฆื ืึทืจืืขืื ืืื ืืขืจ ืื ืืืืื ืืื ืืขื ืคืื ืึท ืืขืืขืงืึธื ืึธืคึผืขืจืึทืืึธืจ, ืขืก ืืึทืจืฃ ืืืื ืืขืืืืงืกื:
net.netfilter.nf_conntrack_max = 3145728
ืขืก ืืื ืืืื ื ืืืืืง ืฆื ืคืึทืจืืจืขืกืขืจื ืื ื ืืืขืจ ืคืื ืืึทืงืึทืฅ ืคึฟืึทืจ ืื ืืึทืฉ ืืืฉ ืกืืึธืจืื ื ืึทืืข ืืจืึธืืงืึทืกืฅ (ืืึธืก ืืื ืึทื ืึธืคึผืฆืืข ืืื ืื nf_conntrack ืืึธืืืืข):
options nf_conntrack hashsize=1572864
ื ืึธื ืื ืคึผืฉืื ืืึทื ืืคึผืืึทืืืืฉืึทื ื, ืึท ืืึธืจ ืืจืืขืื ืคึผืืึทื ืืื ืืืงืืืขื ืืืึธืก ืงืขื ืขื ืืืืขืจืืขืฆื ืึท ืืจืืืก ื ืืืขืจ ืคืื ืงืืืขื ื ืึทืืจืขืกืขืก ืืื ืึท ืืขืงื ืคืื ืคืื ืืจืืืกื ืืืง ืึธื ืขืก. ืึธืืขืจ, ืื ืคืึธืจืฉืืขืืื ื ืคืื ืืขื ืืืืืื ื ืืึธืื ืคืื ืฆื ืืืื ืืขืืืืื. ืืื ืืืื ืขืจืฉืืขืจ ืคืจืืืื ืฆื ื ืืฆื GNU/Linux ืคึฟืึทืจ NAT (ืึทืจืื 2013), ืืื ืืื ืืขืืืขื ืืืืืืช ืฆื ืืึทืงืืืขื ืคืึธืจืฉืืขืืื ื ืคืื ืึทืจืื 7Gbit/s ืืื 0.8Mpps ืคึผืขืจ ืกืขืจืืืขืจ (Xeon E5-1650v2). ืืื ื ืืขืจ ืฆืืื, ืคืืืข ืคืึทืจืฉืืืขื ืข ืึธืคึผืืืืืืึทืืืึธื ืก ืืขื ืขื ืืขืืืื ืืื ืื GNU / Linux ืงืขืจื ื ืขืฅ ืึธื ืืืืื, ืื ืคืึธืจืฉืืขืืื ื ืคืื ืืืื ืกืขืจืืืขืจ ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืืึทืื ืืืึทืจื ืืื ืืขืืืืงืกื ืฆื ืึผืืขื 18-19 Gbit / s ืืื 1.8-1.9 Mpps (ืืึธืก ืืขื ืขื ืื ืืึทืงืกืืืื ืืืึทืืืขืก) , ืึธืืขืจ ืื ืคืึธืืขืจืื ื ืคึฟืึทืจ ืคืึทืจืงืขืจ ืืึทื ื, ืคึผืจืึทืกืขืกื ืืืจื ืืืื ืกืขืจืืืขืจ ืืขืืืืงืกื ืคืื ืคืึทืกืืขืจ. ืืื ืึท ืจืขืืืืืึทื, ืกืงืืื ืืขื ืขื ืืขืืืขืืึธืคึผืขื ืฆื ืืึทืืึทื ืกืืจื ืื ืืึทืกืข ืืืืฃ ืคืึทืจืฉืืืขื ืข ืกืขืจืืืขืจืก, ืึธืืขืจ ืึทืืข ืืขื ืืขืืืืงืกื ืื ืงืึทืืคึผืืขืงืกืืื ืคืื ืืึทืฉืืขืืืงื, ืืืื ืืืื ืื ื ืืื ืืืื ืืืื ืื ื ืื ืงืืืึทืืืืขื ืคืื ืื ืกืขืจืืืืกืขืก ืฆืืืขืฉืืขืื.
ื ืคืืึทืืืขืก
ื ืึธืืืึทืืืึทืก, ืึท ืืึธืืขืจื ืืึทื ื ืืื ืืืืืืืืืจื "ืฉืืคืืื ื ืืึทืืก" ืืื ืื ื ืืฆื ืคืื DPDK ืืื XDP. ืขืก ืืขื ืขื ืืขืฉืจืืื ืคืืืข ืึทืจืืืงืืขื ืืืืฃ ืืขื ืืขืืข, ืคืืืข ืคืึทืจืฉืืืขื ืข ืจืขืืขืก ืืขื ืขื ืืขืืืื ืืื ืืขืฉืขืคื ืคึผืจืึธืืืงืื (ืืืฉื, SKAT ืคืื VasExperts). ืึธืืขืจ ืืขืืขืื ืื ืืืืืืขื ืคึผืจืึธืืจืึทืืืื ื ืจืขืกืืจืกื ืคืื ืืขืืขืงืึธื ืึธืคึผืขืจืืืืขืจื, ืขืก ืืื ืืึทื ืฅ ืคึผืจืึธืืืขืืึทืืืง ืฆื ืฉืึทืคึฟื ืงืืื "ืคึผืจืึธืืืงื" ืืืืืจื ืืืืฃ ืื ืคืจืึทืืขืืืึธืจืงืก ืืืืฃ ืืืื ืืืืื. ืขืก ืืืขื ืืืื ืคืื ืืขืจ ืฉืืืขืจ ืฆื ืึทืจืืขืื ืึทืืึท ืึท ืืืืืื ื ืืื ืืขืจ ืฆืืงืื ืคึฟื; ืกืคึผืขืฆืืขื ืืืึทืื ืึธืกืืืง ืืืฉืืจืื ืืืขื ืืืื ืืขืืืขืืึธืคึผืขื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ื ืึธืจืืึทื tcpdump ืืื DPDK ืืืขื ื ืืฉื ืึทืจืืขืื ืคึผืื ืงื ืึทืืื, ืืื ืขืก ืืืขื ื ืืฉื "ืืขื" ืคึผืึทืงืืฅ ืืขืฉืืงื ืฆืืจืืง ืฆื ืื ืืืืจืขืก ื ืืฆื XDP. ืฆืืืืฉื ืึทืืข ืื ืจืขืื ืืืขืื ื ืืึทืข ืืขืงื ืึทืืึทืืืฉืื ืคึฟืึทืจ ืึทืืืคึผืืฅ ืคึผืึทืงืึทื ืคืึธืจืืืขืจืืื ื ืฆื ืืึทื ืืฆืขืจ-ืคึผืืึทืฅ, ืืื ืืขื ืขื ืึทื ื ืึธืืืืกื ะธ Pablo Neira Ayuso, ืืคึผืืึทืืืขืก ืืึทืื ืืขืจืขืจ, โโืืืขืื ืื ืึทื ืืืืืงืืื ื ืคืื ืืืืคื ืึธืคืืึธืืืื ื ืืื ื ืคืืึทืืืขืก. ืืื ืก ื ืขืืขื ืึท ื ืขืขื ืืขืจ ืงืืง ืืื ืืขื ืืขืงืึทื ืืืึทื.
ืืขืจ ืืืืคึผื ืืขืืึทื ืง ืืื ืึทื ืืืื ืื ืจืึทืืืขืจ ืืืจืืืขืืื ืืขื ืคึผืึทืงืืฅ ืคืื ืืืื ืกืขืกืืข ืืื ืืืืืข ืืื ืกืืจืืงืฆืืขืก ืคืื ืื ืืืืคื (TCP ืกืขืกืืข ืืื ืืขืืืขื ืืื ืื ESTABLISHED ืฉืืึทื), ืขืก ืืื ื ืื ืืึทืจืคึฟื ืฆื ืคืึธืจื ืกืึทืืกืึทืงืืืึทื ื ืคึผืึทืงืืฅ ืคืื ืืขื ืกืขืกืืข ืืืจื ืึทืืข ืคืืืจืืืึทื ืึผืืืื, ืืืืึทื ืึทืืข ืื ืืฉืขืงืก ืืืขื ื ืึธื ืขื ืืืงื ืืื ืื ืคึผืึทืงืึทื ืืจืึทื ืกืคืขืจื ืืืืึทืืขืจ ืฆื ืื ืจืืืื ื. ืืื ืืืจ ืืึธื ื ืื ืืึทืงืข ืืึทืจืคึฟื ืฆื ืืืืกืงืืืึทืื ืึท ืืึทืจืฉืจืื - ืืืจ ืฉืืื ืืืืกื ืฆื ืืืึธืก ืฆืืืื ื ืืื ืฆื ืืืึธืก ืืึทืืขืืึธืก ืืืจ ืืึทืจืคึฟื ืฆื ืฉืืงื ืคึผืึทืงืืฅ ืืื ืืขื ืกืขืกืืข. ืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืงืจืึธื ืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ื ืืฆื ืขืก ืคึฟืึทืจ ืจืืืื ื ืืื ืึท ืคืจื ืืื ืข ืคืื โโืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื. ืืืขื ืคึผืขืจืคืึธืจืืื ื NAT, ืขืก ืืื ื ืืืืืง ืฆื ืืืื ืงืจืึธื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืขื ืืขืจืื ืืขื ืืื ืึทืืจืขืกืขืก ืืื ืคึผืึธืจืฅ ืืืืขืจืืขืืขืฆื ืืืจื ืื nf_conntrack ืืึธืืืืข. ืืึธ, ืืึธื, ืืื ืืขื ืคืึทื, ืคืึทืจืฉืืื ืคึผืึทืืืกืขืจื ืืื ืื ืืขืจืข ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืกืืึทืืืกืืืฉ ืึผืืืื ืืื ืืคึผืืึทืืืขืก ืืึทืืื ืืจืืขืื, ืึธืืขืจ ืืื ืื ืจืึทื ืคืื ืื ืึทืจืืขื ืคืื ืึท ืืึทืืื ืืขืจ ืฉืืืืขื ืืืง NAT ืึธืืขืจ, ืืืฉื, ืึท ืืจืขื ืขืฅ, ืืึธืก ืืื ื ืืฉื ืึทืืื ืืืืืืืง ืืืืึทื ืื ืกืขืจืืืืกืขืก. ืืขื ืขื ืคืื ืื ืืขืจืืขืืืืื ืืืืขืจ ืืืืืืืกืึทื.
ืงืึธื ืคืืืืจืึทืืืึธื
ืฆื ื ืืฆื ืืขื ืคึฟืื ืงืฆืืข ืืืจ ืืึทืจืคึฟื:
- ื ืืฆื ืึท ืคืจืืฉ ืงืขืจื. ืืจืึธืฅ ืืขืจ ืคืึทืงื ืึทื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืื ืืจืืืก ืืื ืงืขืจื 4.16, ืคึฟืึทืจ ืึท ืืึทื ื ืฆืืึทื ืขืก ืืื ืืขืืืขื ืืืืขืจ "ืจืื" ืืื ืงืขืกืืืืขืจ ืืขืคึฟืืจื ืงืขืจื ืคึผืึทื ืืง. ืึทืืฅ ืกืืืืืึทืืืืื ืึทืจืื ืืขืฆืขืืืขืจ 2019, ืืืขื LTS ืงืขืจื ืึทืื 4.19.90 ืืื 5.4.5 ืืขื ืขื ืืืคืจืืื.
- ืจืืจืืื ืืคึผืืึทืืืขืก ืึผืืืื ืืื nftables ืคึฟืึธืจืืึทื ืืื ืึท ืคืขืจืื ืคืจืืฉ ืืืขืจืกืืข ืคืื โโnftables. ืึทืจืืขื ืคึผืื ืงื ืืื ืืืขืจืกืืข 0.9.0
ืืืื ืึทืืฅ ืืื ืคึผืจืื ืฆืืคึผ ืืื ืงืืึธืจ ืืื ืืขืจ ืขืจืฉืืขืจ ืคืื ื, ืื ืืืืคึผื ืืึทื ืืื ื ืืฉื ืฆื ืคืึทืจืืขืกื ืฆื ืึทืจืืึทื ื ืขืืขื ืื ืืึธืืืืข ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืฉืึทืก ืคึฟืึทืจืืึทืืืื ื (CONFIG_NFT_FLOW_OFFLOAD=m), ืืขืืึธืื ืืขืจ ืฆืืืืืืขืจ ืคืื ื ืจืืงืืืืืขืจื ืืขืจืงืืขืจืื ื. nftables ืึผืืืื ืืขื ืขื ืืืกืงืจืืืื ืืึธืจ ืึทื ืืขืจืฉ ืืื ืืื iptables. ืจืืืืืื ืึผืืขื ืึทืืข ืคืื ืงืื, ืขืก ืืขื ืขื ืืืื ืกืคึผืขืฆืืขื ืึผืืืื ืคืื iptables ืฆื nftables. ืืขืจืืืขืจ, ืืื ืืืขื ื ืึธืจ ืืขืื ืึท ืืืืฉืคึผืื ืคืื ืืึทืฉืืขืืืงื NAT ืืื ืืืืคื ืึธืคืืึธืึทื. ื ืงืืืื ืืขืืขื ืืข ืืืฉื: , - ืืึธืก ืืขื ืขื ืื ื ืขืฅ ืื ืืขืจืคืืืกืื ืืืจื ืืืึธืก ืคืึทืจืงืขืจ ืคึผืึทืกืื; ืืื ืคืึทืงื ืขืก ืงืขื ืขื ืืืื ืืขืจ ืืื ืฆืืืื ืคืื ืืื. , - ืื ืึธื ืืืื ืืื ืกืึธืฃ ืึทืืจืขืก ืคืื ืื ืงืืื ืคืื "ืืืืึทืก" ืึทืืจืขืกืขืก.
NAT ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืืืขืจ ืคึผืฉืื:
#! /usr/sbin/nft -f
table nat {
chain postrouting {
type nat hook postrouting priority 100;
oif <o_if> snat to <pool_addr_start>-<pool_addr_end> persistent
}
}
ืืื ืืืืคื ืึธืคืืึธืึทื ืขืก ืืื ืึท ืืืกื ืืขืจ ืงืึธืืคึผืืืฆืืจื, ืึธืืขืจ ืืึทื ืฅ ืคืึทืจืฉืืืืืง:
#! /usr/sbin/nft -f
table inet filter {
flowtable fastnat {
hook ingress priority 0
devices = { <i_if>, <o_if> }
}
chain forward {
type filter hook forward priority 0; policy accept;
ip protocol { tcp , udp } flow offload @fastnat;
}
}
ืึทื, ืืื ืคืึทืงื, ืืื ืื ืืื ืฆืข ืกืขืืึทืคึผ. ืืืฆื ืึทืืข TCP / UDP ืคืึทืจืงืขืจ ืืืขื ืคืึทืื ืืื ืื ืคืึทืกืื ืึทื ืืืฉ ืืื ืืืื ืคึผืจืึทืกืขืกื ืคืื ืคืึทืกืืขืจ.
ืจืขืืืืืึทืื
ืฆื ืืึทืื ืขืก ืงืืึธืจ ืืื "ืคืื ืคืึทืกืืขืจ" ืืึธืก ืืื, ืืื ืืืขื ืฆืืืฉืขืคึผืขื ืึท ืกืงืจืขืขื ืฉืึธื ืคืื ืื ืืึทืกืข ืืืืฃ ืฆืืืื ืคืึทืงืืืฉ ืกืขืจืืืขืจืก, ืืื ืืขืจ ืืขืืืืงืขืจ ืืึทืื ืืืึทืจื (Xeon E5-1650v2), ืืืืขื ืืงืึทื ืงืึทื ืคืืืืขืจื, ื ืืฆื ืื ืืขืืืข ืืื ืืงืก ืงืขืจื, ืึธืืขืจ ืืืจืืคืืจื NAT ืืื ืืคึผืืึทืืืขืก. (NAT4) ืืื ืืื ื ืคืืึทืืืขืก (NAT5).
ืขืก ืืื ืงืืื ืืจืึทืคืืง ืคืื ืคึผืึทืงืืฅ ืคึผืขืจ ืกืขืงืื ืืข ืืื ืื ืกืงืจืขืขื ืฉืึธื, ืึธืืขืจ ืืื ืื ืืึทืกืข ืคึผืจืึธืคืื ืคืื ืื ืกืขืจืืืขืจืก ืื ืืืจืืฉื ืืืืขื ืคึผืึทืงืึทื ืืจืืืก ืืื ืึทืจืื 800 ืืืืขืก, ืึทืืื ืื ืืืึทืืืขืก ืืขืจืืจืืืื ืึทืจืืืฃ ืฆื 1.5 ืืคึผืก. ืืื ืืืจ ืงืขื ืขื ืืขื, ืืขืจ ืกืขืจืืืขืจ ืืื nftables ืืื ืึท ืจืืืืง ืคืึธืจืฉืืขืืื ื ืจืขืืขืจืื. ืืขืจืืืืึทื, ืืขืจ ืกืขืจืืืขืจ ืคึผืจืึทืกืขืกืึทื ืึทืจืืืฃ ืฆื 30Gbit / s ืืื 3Mpps ืืื ืืื ืงืืืจ ืืืืืขืืืืืง ืฆื ืืจืขืคื ืื ืืฉืืืืช ื ืขืฅ ืืึทืืจืขื ืขืฆืื ื ืคืื 40Gbps, ืืฉืขืช ืืืจ ืืึธืื ืคืจืื ืงืคึผื ืจืขืกืืจืกื.
ืืื ืืึธืคึฟื ืืขื ืืึทืืขืจืืึทื ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ื ืขืฅ ืขื ืืืฉืึทื ืืจื ืืจืืื ื ืฆื ืคึฟืึทืจืืขืกืขืจื ืื ืคืึธืจืฉืืขืืื ื ืคืื ืืืืขืจ ืกืขืจืืืขืจืก.
ืืงืืจ: www.habr.com