\u5b9e\u65bd\u5f3a\u5927\u7684\u6e38\u620f\u52a0\u901f\u5668\u9700\u8981\u7cbe\u786e\u7684\u7cfb\u7edf\u914d\u7f6e\u3002\u8ba9\u6211\u4eec\u5206\u89e3\u5173\u952e\u6b65\u9aa4\uff1a<\/p>\n

\n
1. \u521d\u59cb\u7cfb\u7edf\u4f18\u5316\n

   # \u542f\u7528BBR\u8fdb\u884cTCP\u4f18\u5316\r\necho \"net.core.default_qdisc=fq\" >> \/etc\/sysctl.conf\r\necho \"net.ipv4.tcp_congestion_control=bbr\" >> \/etc\/sysctl.conf\r\nsysctl -p\r\n\r\n# \u4f18\u5316\u7f51\u7edc\u53c2\u6570\r\necho \"net.ipv4.tcp_fastopen = 3\" >> \/etc\/sysctl.conf\r\necho \"net.ipv4.tcp_fin_timeout = 30\" >> \/etc\/sysctl.conf<\/code><\/pre>\n<\/li>\n<\/ol>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u534f\u8bae\u5b9e\u65bd\u7b56\u7565<\/strong><\/h2>\n
   \u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u6700\u4f73\u534f\u8bae\u6808\uff1a<\/p>\n
   \n
   IPLC\uff08\u56fd\u9645\u4e13\u7ebf\uff09\n
   \n
   \u6700\u4f4e\u5ef6\u8fdf<\/li>\n
   \u4e13\u7528\u5e26\u5bbd<\/li>\n
   \u8f83\u9ad8\u6210\u672c\u56e0\u7d20<\/li>\n<\/ul>\n<\/li>\n
   WireGuard\n
   \n
   \u73b0\u4ee3\u52a0\u5bc6\u6280\u672f<\/li>\n
   \u5185\u6838\u7ea7\u6027\u80fd<\/li>\n
   \u6700\u5c0f\u5f00\u9500<\/li>\n<\/ul>\n<\/li>\n
   \u6df7\u5408\u89e3\u51b3\u65b9\u6848\n
   \n
   \u534f\u8bae\u591a\u8def\u590d\u7528<\/li>\n
   \u52a8\u6001\u8def\u7531<\/li>\n
   \u8d1f\u8f7d\u5747\u8861\u80fd\u529b<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u9ad8\u7ea7\u7f51\u7edc\u4f18\u5316<\/strong><\/h2>\n
   \u5b9e\u65bd\u4ee5\u4e0b\u9ad8\u7ea7\u7f51\u7edc\u6280\u672f\u4ee5\u83b7\u5f97\u6700\u4f73\u6027\u80fd\uff1a<\/p>\n
   \n
   TCP\u5feb\u901f\u6253\u5f00\uff08TFO\uff09\u5b9e\u65bd\n
   # \u5728nginx\u914d\u7f6e\u4e2d\u542f\u7528TFO\r\ntcp_fastopen on;\r\nlisten 443 ssl http2 fastopen=3;<\/code><\/pre>\n<\/li>\n
   \u591a\u8def\u5f84TCP\u914d\u7f6e\n
   # \u542f\u7528MPTCP\u652f\u6301\r\nip link set dev eth0 multipath on\r\nip route add default scope global nexthop via $GATEWAY dev eth0<\/code><\/pre>\n<\/li>\n<\/ol>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6027\u80fd\u76d1\u63a7\u548c\u4f18\u5316<\/strong><\/h2>\n
   \u5b9e\u65bd\u5f3a\u5927\u7684\u76d1\u63a7\u7cfb\u7edf\u5bf9\u4e8e\u7ef4\u6301\u6700\u4f73\u52a0\u901f\u5668\u6027\u80fd\u81f3\u5173\u91cd\u8981\uff1a<\/p>\n
   \u5b9e\u65f6\u6307\u6807\u6536\u96c6<\/h3>\n
   \n
   \u7f51\u7edc\u6027\u80fd\u6307\u6807\n
   # \u5b89\u88c5\u7f51\u7edc\u76d1\u63a7\u5de5\u5177\r\napt install -y nethogs iftop tcpdump\r\n\r\n# \u914d\u7f6ePrometheus\u6307\u6807\r\nnode_network_receive_bytes_total\r\nnode_network_transmit_bytes_total<\/code><\/pre>\n<\/li>\n
   \u7cfb\u7edf\u8d44\u6e90\u76d1\u63a7\n
   # \u914d\u7f6e\u8d44\u6e90\u8b66\u62a5\r\nALERT high_cpu_load\r\n  IF node_load1 > 10\r\n  FOR 5m\r\n  LABELS { severity = \"warning\" }<\/code><\/pre>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u8d1f\u8f7d\u5747\u8861\u67b6\u6784<\/strong><\/h2>\n
   \u5b9e\u65bd\u5206\u5e03\u5f0f\u8d1f\u8f7d\u5747\u8861\u7cfb\u7edf\u4ee5\u5b9e\u73b0\u6700\u4f73\u6d41\u91cf\u5206\u914d\uff1a<\/p>\n
   \n
   \u7b2c4\u5c42\u8d1f\u8f7d\u5747\u8861\n
   \n
   \u76f4\u63a5\u670d\u52a1\u5668\u8fd4\u56de\uff08DSR\uff09<\/li>\n
   \u7b49\u4ef7\u591a\u8def\u5f84\u8def\u7531\uff08ECMP\uff09<\/li>\n
   \u4f7f\u7528\u4e00\u81f4\u6027\u54c8\u5e0c\u7684\u8fde\u63a5\u6301\u4e45\u6027<\/li>\n<\/ul>\n<\/li>\n
   \u5065\u5eb7\u68c0\u67e5\u7cfb\u7edf\n
   # \u5065\u5eb7\u68c0\u67e5\u914d\u7f6e\r\ncheck_interval 2000\r\ntimeout 1000\r\nrise 2\r\nfall 5<\/code><\/pre>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u81ea\u52a8\u6545\u969c\u8f6c\u79fb\u7cfb\u7edf<\/strong><\/h2>\n
   \u90e8\u7f72\u81ea\u52a8\u6545\u969c\u8f6c\u79fb\u673a\u5236\u4ee5\u786e\u4fdd\u670d\u52a1\u6301\u7eed\u6027\uff1a<\/p>\n
   \n
   \u4e3b\u5907\u914d\u7f6e\n
   # Keepalived\u914d\u7f6e\r\nvrrp_instance VI_1 {\r\n    state MASTER\r\n    interface eth0\r\n    virtual_router_id 51\r\n    priority 100\r\n    authentication {\r\n        auth_type PASS\r\n        auth_pass secure_pass\r\n    }\r\n}<\/code><\/pre>\n<\/li>\n
   \u81ea\u52a8\u6062\u590d\u7a0b\u5e8f\n
   \n
   \u670d\u52a1\u5065\u5eb7\u76d1\u63a7<\/li>\n
   \u81ea\u52a8\u5b9e\u4f8b\u6062\u590d<\/li>\n
   DNS\u6545\u969c\u8f6c\u79fb\u914d\u7f6e<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u5b89\u5168\u5b9e\u65bd<\/strong><\/h2>\n
   \u5b9e\u65bd\u5168\u9762\u7684\u5b89\u5168\u63aa\u65bd\u4ee5\u4fdd\u62a4\u60a8\u7684\u52a0\u901f\u57fa\u7840\u8bbe\u65bd\uff1a<\/p>\n
   \n
   DDoS\u7f13\u89e3\n
   # \u914d\u7f6eiptables\u89c4\u5219\r\niptables -A INPUT -p tcp --syn -m limit --limit 1\/s -j ACCEPT\r\niptables -A INPUT -p tcp --syn -j DROP<\/code><\/pre>\n<\/li>\n
   \u8bbf\u95ee\u63a7\u5236\u5217\u8868\n
   \n
   \u57fa\u4e8eIP\u7684\u767d\u540d\u5355<\/li>\n
   \u5ba2\u6237\u7aef\u901f\u7387\u9650\u5236<\/li>\n
   \u5730\u7406\u4f4d\u7f6e\u8bbf\u95ee\u9650\u5236<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6210\u672c\u5206\u6790\u548c\u4f18\u5316<\/strong><\/h2>\n
   \u4e86\u89e3\u6210\u672c\u7ed3\u6784\u5bf9\u4e8e\u7ef4\u6301\u53ef\u6301\u7eed\u7684\u6e38\u620f\u52a0\u901f\u670d\u52a1\u81f3\u5173\u91cd\u8981\uff1a<\/p>\n
   \n
   \u57fa\u7840\u8bbe\u65bd\u6210\u672c\n
   \n
   \u670d\u52a1\u5668\u79df\u7528\u6210\u672c\u6839\u636e\u914d\u7f6e\u548c\u4f9b\u5e94\u5546\u800c\u5f02<\/li>\n
   \u5e26\u5bbd\u5b9a\u4ef7\u53d6\u51b3\u4e8e\u4f7f\u7528\u91cf\u548c\u627f\u8bfa\u671f\u9650<\/li>\n
   \u4e0d\u540c\u9a8c\u8bc1\u7ea7\u522b\u7684SSL\u8bc1\u4e66<\/li>\n<\/ul>\n<\/li>\n
   \u8fd0\u8425\u652f\u51fa\n
   \n
   \u76d1\u63a7\u5de5\u5177\u8ba2\u9605<\/li>\n
   \u57fa\u4e8e\u8986\u76d6\u7ea7\u522b\u7684DDoS\u9632\u62a4\u670d\u52a1<\/li>\n
   \u5907\u4efd\u5b58\u50a8\u89e3\u51b3\u65b9\u6848<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6027\u80fd\u6307\u6807\u548c\u57fa\u51c6<\/strong><\/h2>\n
   \u9700\u8981\u76d1\u63a7\u7684\u5173\u952e\u6027\u80fd\u6307\u6807\uff1a<\/p>\n
   \n
   \u7f51\u7edc\u6027\u80fd\n
   \n
   \u5ef6\u8fdf\uff1a\u8fde\u63a5\u4e3b\u8981\u6e38\u620f\u670d\u52a1\u5668\u5c0f\u4e8e50ms<\/li>\n
   \u4e22\u5305\u7387\uff1a\u5c0f\u4e8e0.1%<\/li>\n
   \u6296\u52a8\uff1a\u5c0f\u4e8e5ms<\/li>\n<\/ul>\n<\/li>\n
   \u7cfb\u7edf\u6548\u7387\n
   \n
   CPU\u5229\u7528\u7387\uff1a\u5c0f\u4e8e70%<\/li>\n
   \u5185\u5b58\u4f7f\u7528\u7387\uff1a\u5c0f\u4e8e80%<\/li>\n
   \u7f51\u7edc\u541e\u5410\u91cf\uff1a\u5927\u4e8e\u5bb9\u91cf\u768480%<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6700\u4f73\u5b9e\u8df5\u548c\u5efa\u8bae<\/strong><\/h2>\n
   \u9075\u5faa\u4ee5\u4e0b\u6280\u672f\u6307\u5357\u4ee5\u83b7\u5f97\u6700\u4f73\u6027\u80fd\uff1a<\/p>\n
   \n
   \u57fa\u7840\u8bbe\u65bd\u7ba1\u7406\n
   \n
   \u5b9e\u65bd\u81ea\u52a8\u5907\u4efd\u7cfb\u7edf<\/li>\n
   \u4f7f\u7528\u914d\u7f6e\u7ba1\u7406\u5de5\u5177<\/li>\n
   \u7ef4\u62a4\u8be6\u7ec6\u6587\u6863<\/li>\n<\/ul>\n<\/li>\n
   \u6027\u80fd\u4f18\u5316\n
   \n
   \u5b9a\u671f\u5185\u6838\u66f4\u65b0<\/li>\n
   \u7f51\u7edc\u6808\u8c03\u4f18<\/li>\n
   \u534f\u8bae\u4f18\u5316<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u7ed3\u8bba<\/h2>\n
   \u4f7f\u7528\u4e1c\u4eac\u670d\u52a1\u5668\u6784\u5efa\u6e38\u620f\u52a0\u901f\u5668\u9700\u8981\u4ed4\u7ec6\u8003\u8651\u7f51\u7edc\u67b6\u6784\u3001\u6027\u80fd\u4f18\u5316\u548c\u6210\u672c\u7ba1\u7406\u3002\u4e1c\u4eac\u57fa\u7840\u8bbe\u65bd\u7684\u6218\u7565\u4f18\u52bf\uff0c\u7ed3\u5408\u52a0\u901f\u6280\u672f\u548c\u76d1\u63a7\u7cfb\u7edf\u7684\u6b63\u786e\u5b9e\u65bd\uff0c\u53ef\u4ee5\u63d0\u4f9b\u5353\u8d8a\u7684\u6e38\u620f\u4f53\u9a8c\u3002\u8bf7\u8bb0\u4f4f\u5b9a\u671f\u66f4\u65b0\u57fa\u7840\u8bbe\u65bd\u5e76\u53ca\u65f6\u4e86\u89e3\u6700\u65b0\u7684\u4f18\u5316\u6280\u672f\uff0c\u4ee5\u4fdd\u6301\u6e38\u620f\u52a0\u901f\u670d\u52a1\u7684\u7ade\u4e89\u4f18\u52bf\u3002<\/p>\n
   \u4e3a\u83b7\u5f97\u6700\u4f73\u7ed3\u679c\uff0c\u8bf7\u8003\u8651\u5b9e\u65bd\u7ed3\u5408\u591a\u79cd\u52a0\u901f\u65b9\u6cd5\u7684\u6df7\u5408\u65b9\u6848\uff0c\u5e76\u7ef4\u62a4\u5f3a\u5927\u7684\u76d1\u63a7\u7cfb\u7edf\u3002\u6210\u529f\u7684\u5173\u952e\u5728\u4e8e\u5e73\u8861\u6027\u80fd\u9700\u6c42\u548c\u57fa\u7840\u8bbe\u65bd\u6210\u672c\uff0c\u540c\u65f6\u901a\u8fc7\u4e1c\u4eac\u670d\u52a1\u5668\u79df\u7528\u89e3\u51b3\u65b9\u6848\u786e\u4fdd\u53ef\u9760\u7684\u670d\u52a1\u4ea4\u4ed8\u3002<\/p>\n
   [\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
   [vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] \u4f7f\u7528\u4e1c\u4eac\u670d\u52a1\u5668\u6784\u5efa\u6e38\u620f\u52a0\u901f\u5668\u5df2\u7ecf\u6210\u4e3a\u6280\u672f\u7231\u597d\u8005\u8ffd\u6c42\u6700\u4f73\u6e38\u620f\u6027\u80fd\u7684\u70ed\u95e8\u9009\u62e9\u3002\u65e5\u672c\u7684\u6218\u7565\u4f4d\u7f6e\u548c\u5148\u8fdb\u57fa\u7840\u8bbe\u65bd\u4f7f\u4e1c\u4eac\u670d\u52a1\u5668\u6210\u4e3a\u5728\u4e9a\u592a\u5730\u533a\u5efa\u7acb\u4f4e\u5ef6\u8fdf\u8fde\u63a5\u7684\u7406\u60f3\u9009\u62e9\u3002\u672c\u7efc\u5408\u6307\u5357\u5c06\u63a2\u8ba8\u4f7f\u7528\u57fa\u4e8e\u4e1c\u4eac\u7684\u670d\u52a1\u5668\u79df\u7528\u89e3\u51b3\u65b9\u6848\u5efa\u7acb\u9ad8\u6027\u80fd\u6e38\u620f\u52a0\u901f\u7cfb\u7edf\u7684\u6280\u672f\u7ec6\u8282\u3002 [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] \u4e1c\u4eac\u670d\u52a1\u5668\u7684\u6218\u7565\u4f18\u52bf \u5730\u7406\u4f4d\u7f6e\u4f18\u52bf\uff0c\u53ef\u5b9e\u73b0\u4e3b\u8981\u6e38\u620f\u670d\u52a1\u5668\u6700\u5c0f\u5ef6\u8fdf \u9ad8\u5bb9\u91cf\u6d77\u5e95\u5149\u7f06\u8fde\u63a5 \u5148\u8fdb\u7684\u4e00\u7ea7\u7f51\u7edc\u57fa\u7840\u8bbe\u65bd \u53ef\u9760\u7684\u7535\u7f51\uff0c\u6b63\u5e38\u8fd0\u884c\u65f6\u95f4\u8fbe99.999% [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] \u6280\u672f\u51c6\u5907\u5de5\u4f5c \u5728\u5f00\u59cb\u8bbe\u7f6e\u8fc7\u7a0b\u4e4b\u524d\uff0c\u8bf7\u786e\u4fdd\u51c6\u5907\u597d\u4ee5\u4e0b\u57fa\u672c\u7ec4\u4ef6\uff1a \u4e00\u53f0\u4f4d\u4e8e\u4e1c\u4eac\u7684\u670d\u52a1\u5668\uff0c\u6700\u4f4e\u914d\u7f6e\u8981\u6c42\uff1a CPU\uff1a4\u6838\u4ee5\u4e0a \u5185\u5b58\uff1a\u6700\u5c118GB \u7f51\u7edc\uff1a1Gbps\u7aef\u53e3 \u56fa\u6001\u786c\u76d8\uff1a50GB\u4ee5\u4e0a \u670d\u52a1\u5668\u73af\u5883\u7684root\u8bbf\u95ee\u6743\u9650 \u57fa\u672c\u7684Linux\u7cfb\u7edf\u7ba1\u7406\u77e5\u8bc6 \u7528\u4e8e\u5b89\u5168\u670d\u52a1\u5668\u8bbf\u95ee\u7684SSH\u5ba2\u6237\u7aef [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] \u6838\u5fc3\u7cfb\u7edf\u914d\u7f6e \u5b9e\u65bd\u5f3a\u5927\u7684\u6e38\u620f\u52a0\u901f\u5668\u9700\u8981\u7cbe\u786e\u7684\u7cfb\u7edf\u914d\u7f6e\u3002\u8ba9\u6211\u4eec\u5206\u89e3\u5173\u952e\u6b65\u9aa4\uff1a \u521d\u59cb\u7cfb\u7edf\u4f18\u5316 # \u542f\u7528BBR\u8fdb\u884cTCP\u4f18\u5316 echo “net.core.default_qdisc=fq” >> \/etc\/sysctl.conf echo “net.ipv4.tcp_congestion_control=bbr” >> \/etc\/sysctl.conf sysctl -p # \u4f18\u5316\u7f51\u7edc\u53c2\u6570 echo “net.ipv4.tcp_fastopen = 3” >> \/etc\/sysctl.conf echo “net.ipv4.tcp_fin_timeout = 30” […]<\/p>\n
   Read More…<\/a><\/p>\n","protected":false},"author":1,"featured_media":27839,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8117],"tags":[9103,8163,5355,1949,353],"class_list":["post-27842","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-japan-dedicated-server-sc","tag-bbr-acceleration","tag-japan-server-hosting-sc","tag-game-accelerator-sc","tag-network-optimization-sc","tag-server-rental-sc"],"acf":[],"yoast_head":"\n