\u5be6\u65bd\u5f37\u5927\u7684\u904a\u6232\u52a0\u901f\u5668\u9700\u8981\u7cbe\u78ba\u7684\u7cfb\u7d71\u914d\u7f6e\u3002\u8b93\u6211\u5011\u5206\u89e3\u95dc\u9375\u6b65\u9a5f\uff1a<\/p>\n

\n
1. \u521d\u59cb\u7cfb\u7d71\u6700\u4f73\u5316\n

   # \u555f\u7528BBR\u9032\u884cTCP\u6700\u4f73\u5316\r\necho \"net.core.default_qdisc=fq\" >> \/etc\/sysctl.conf\r\necho \"net.ipv4.tcp_congestion_control=bbr\" >> \/etc\/sysctl.conf\r\nsysctl -p\r\n\r\n# \u6700\u4f73\u5316\u7db2\u8def\u53c3\u6578\r\necho \"net.ipv4.tcp_fastopen = 3\" >> \/etc\/sysctl.conf\r\necho \"net.ipv4.tcp_fin_timeout = 30\" >> \/etc\/sysctl.conf<\/code><\/pre>\n<\/li>\n<\/ol>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u5354\u5b9a\u5be6\u65bd\u7b56\u7565<\/strong><\/h2>\n
   \u6839\u64da\u5177\u9ad4\u9700\u6c42\u9078\u64c7\u6700\u4f73\u5354\u5b9a\u5806\u758a\uff1a<\/p>\n
   \n
   IPLC\uff08\u570b\u969b\u5c08\u7dda\uff09\n
   \n
   \u6700\u4f4e\u5ef6\u9072<\/li>\n
   \u5c08\u7528\u983b\u5bec<\/li>\n
   \u8f03\u9ad8\u6210\u672c\u56e0\u7d20<\/li>\n<\/ul>\n<\/li>\n
   WireGuard\n
   \n
   \u73fe\u4ee3\u52a0\u5bc6\u6280\u8853<\/li>\n
   \u6838\u5fc3\u7d1a\u6548\u80fd<\/li>\n
   \u6700\u5c0f\u958b\u92b7<\/li>\n<\/ul>\n<\/li>\n
   \u6df7\u5408\u89e3\u6c7a\u65b9\u6848\n
   \n
   \u5354\u5b9a\u591a\u8def\u8907\u7528<\/li>\n
   \u52d5\u614b\u8def\u7531<\/li>\n
   \u8ca0\u8f09\u5e73\u8861\u80fd\u529b<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u9032\u968e\u7db2\u8def\u6700\u4f73\u5316<\/strong><\/h2>\n
   \u5be6\u65bd\u4ee5\u4e0b\u9032\u968e\u7db2\u8def\u6280\u8853\u4ee5\u7372\u5f97\u6700\u4f73\u6548\u80fd\uff1a<\/p>\n
   \n
   TCP\u5feb\u901f\u958b\u555f\uff08TFO\uff09\u5be6\u65bd\n
   # \u5728nginx\u914d\u7f6e\u4e2d\u555f\u7528TFO\r\ntcp_fastopen on;\r\nlisten 443 ssl http2 fastopen=3;<\/code><\/pre>\n<\/li>\n
   \u591a\u8def\u5f91TCP\u914d\u7f6e\n
   # \u555f\u7528MPTCP\u652f\u63f4\r\nip link set dev eth0 multipath on\r\nip route add default scope global nexthop via $GATEWAY dev eth0<\/code><\/pre>\n<\/li>\n<\/ol>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6548\u80fd\u76e3\u63a7\u548c\u6700\u4f73\u5316<\/strong><\/h2>\n
   \u5be6\u65bd\u5f37\u5927\u7684\u76e3\u63a7\u7cfb\u7d71\u5c0d\u65bc\u7dad\u6301\u6700\u4f73\u52a0\u901f\u5668\u6548\u80fd\u81f3\u95dc\u91cd\u8981\uff1a<\/p>\n
   \u5373\u6642\u6307\u6a19\u6536\u96c6<\/h3>\n
   \n
   \u7db2\u8def\u6548\u80fd\u6307\u6a19\n
   # \u5b89\u88dd\u7db2\u8def\u76e3\u63a7\u5de5\u5177\r\napt install -y nethogs iftop tcpdump\r\n\r\n# \u914d\u7f6ePrometheus\u6307\u6a19\r\nnode_network_receive_bytes_total\r\nnode_network_transmit_bytes_total<\/code><\/pre>\n<\/li>\n
   \u7cfb\u7d71\u8cc7\u6e90\u76e3\u63a7\n
   # \u914d\u7f6e\u8cc7\u6e90\u8b66\u5831\r\nALERT high_cpu_load\r\n  IF node_load1 > 10\r\n  FOR 5m\r\n  LABELS { severity = \"warning\" }<\/code><\/pre>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u8ca0\u8f09\u5e73\u8861\u67b6\u69cb<\/strong><\/h2>\n
   \u5be6\u65bd\u5206\u6563\u5f0f\u8ca0\u8f09\u5e73\u8861\u7cfb\u7d71\u4ee5\u5be6\u73fe\u6700\u4f73\u6d41\u91cf\u5206\u914d\uff1a<\/p>\n
   \n
   \u7b2c4\u5c64\u8ca0\u8f09\u5e73\u8861\n
   \n
   \u76f4\u63a5\u4f3a\u670d\u5668\u8fd4\u56de\uff08DSR\uff09<\/li>\n
   \u7b49\u50f9\u591a\u8def\u5f91\u8def\u7531\uff08ECMP\uff09<\/li>\n
   \u4f7f\u7528\u4e00\u81f4\u6027\u96dc\u6e4a\u7684\u9023\u63a5\u6301\u4e45\u6027<\/li>\n<\/ul>\n<\/li>\n
   \u5065\u5eb7\u6aa2\u67e5\u7cfb\u7d71\n
   # \u5065\u5eb7\u6aa2\u67e5\u914d\u7f6e\r\ncheck_interval 2000\r\ntimeout 1000\r\nrise 2\r\nfall 5<\/code><\/pre>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u81ea\u52d5\u5bb9\u932f\u7cfb\u7d71<\/strong><\/h2>\n
   \u90e8\u7f72\u81ea\u52d5\u5bb9\u932f\u6a5f\u5236\u4ee5\u78ba\u4fdd\u670d\u52d9\u6301\u7e8c\u6027\uff1a<\/p>\n
   \n
   \u4e3b\u5099\u914d\u7f6e\n
   # Keepalived\u914d\u7f6e\r\nvrrp_instance VI_1 {\r\n    state MASTER\r\n    interface eth0\r\n    virtual_router_id 51\r\n    priority 100\r\n    authentication {\r\n        auth_type PASS\r\n        auth_pass secure_pass\r\n    }\r\n}<\/code><\/pre>\n<\/li>\n
   \u81ea\u52d5\u5fa9\u539f\u7a0b\u5e8f\n
   \n
   \u670d\u52d9\u5065\u5eb7\u76e3\u63a7<\/li>\n
   \u81ea\u52d5\u5be6\u4f8b\u5fa9\u539f<\/li>\n
   DNS\u5bb9\u932f\u914d\u7f6e<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u5b89\u5168\u5be6\u65bd<\/strong><\/h2>\n
   \u5be6\u65bd\u5b8c\u6574\u7684\u5b89\u5168\u63aa\u65bd\u4ee5\u4fdd\u8b77\u60a8\u7684\u52a0\u901f\u57fa\u790e\u8a2d\u65bd\uff1a<\/p>\n
   \n
   DDoS\u7de9\u89e3\n
   # \u914d\u7f6eiptables\u898f\u5247\r\niptables -A INPUT -p tcp --syn -m limit --limit 1\/s -j ACCEPT\r\niptables -A INPUT -p tcp --syn -j DROP<\/code><\/pre>\n<\/li>\n
   \u5b58\u53d6\u63a7\u5236\u6e05\u55ae\n
   \n
   \u57fa\u65bcIP\u7684\u767d\u540d\u55ae<\/li>\n
   \u7528\u6236\u7aef\u901f\u7387\u9650\u5236<\/li>\n
   \u5730\u7406\u4f4d\u7f6e\u5b58\u53d6\u9650\u5236<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6210\u672c\u5206\u6790\u548c\u6700\u4f73\u5316<\/strong><\/h2>\n
   \u4e86\u89e3\u6210\u672c\u7d50\u69cb\u5c0d\u65bc\u7dad\u6301\u53ef\u6301\u7e8c\u7684\u904a\u6232\u52a0\u901f\u670d\u52d9\u81f3\u95dc\u91cd\u8981\uff1a<\/p>\n
   \n
   \u57fa\u790e\u8a2d\u65bd\u6210\u672c\n
   \n
   \u4f3a\u670d\u5668\u79df\u7528\u6210\u672c\u6839\u64da\u914d\u7f6e\u548c\u4f9b\u61c9\u5546\u800c\u7570<\/li>\n
   \u983b\u5bec\u5b9a\u50f9\u53d6\u6c7a\u65bc\u4f7f\u7528\u91cf\u548c\u627f\u8afe\u671f\u9650<\/li>\n
   \u4e0d\u540c\u9a57\u8b49\u7d1a\u5225\u7684SSL\u6191\u8b49<\/li>\n<\/ul>\n<\/li>\n
   \u71df\u904b\u652f\u51fa\n
   \n
   \u76e3\u63a7\u5de5\u5177\u8a02\u95b1<\/li>\n
   \u57fa\u65bc\u8986\u84cb\u7d1a\u5225\u7684DDoS\u9632\u8b77\u670d\u52d9<\/li>\n
   \u5099\u4efd\u5132\u5b58\u89e3\u6c7a\u65b9\u6848<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6548\u80fd\u6307\u6a19\u548c\u57fa\u6e96<\/strong><\/h2>\n
   \u9700\u8981\u76e3\u63a7\u7684\u95dc\u9375\u6548\u80fd\u6307\u6a19\uff1a<\/p>\n
   \n
   \u7db2\u8def\u6548\u80fd\n
   \n
   \u5ef6\u9072\uff1a\u9023\u63a5\u4e3b\u8981\u904a\u6232\u4f3a\u670d\u5668\u5c0f\u65bc50ms<\/li>\n
   \u5c01\u5305\u907a\u5931\u7387\uff1a\u5c0f\u65bc0.1%<\/li>\n
   \u6296\u52d5\uff1a\u5c0f\u65bc5ms<\/li>\n<\/ul>\n<\/li>\n
   \u7cfb\u7d71\u6548\u7387\n
   \n
   CPU\u4f7f\u7528\u7387\uff1a\u5c0f\u65bc70%<\/li>\n
   \u8a18\u61b6\u9ad4\u4f7f\u7528\u7387\uff1a\u5c0f\u65bc80%<\/li>\n
   \u7db2\u8def\u541e\u5410\u91cf\uff1a\u5927\u65bc\u5bb9\u91cf\u768480%<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u6700\u4f73\u5be6\u8e10\u548c\u5efa\u8b70<\/strong><\/h2>\n
   \u9075\u5faa\u4ee5\u4e0b\u6280\u8853\u6307\u5357\u4ee5\u7372\u5f97\u6700\u4f73\u6548\u80fd\uff1a<\/p>\n
   \n
   \u57fa\u790e\u8a2d\u65bd\u7ba1\u7406\n
   \n
   \u5be6\u65bd\u81ea\u52d5\u5099\u4efd\u7cfb\u7d71<\/li>\n
   \u4f7f\u7528\u914d\u7f6e\u7ba1\u7406\u5de5\u5177<\/li>\n
   \u7dad\u8b77\u8a73\u7d30\u6587\u4ef6<\/li>\n<\/ul>\n<\/li>\n
   \u6548\u80fd\u6700\u4f73\u5316\n
   \n
   \u5b9a\u671f\u6838\u5fc3\u66f4\u65b0<\/li>\n
   \u7db2\u8def\u5806\u758a\u8abf\u6821<\/li>\n
   \u5354\u5b9a\u6700\u4f73\u5316<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
   [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
   \u7d50\u8ad6<\/strong><\/h2>\n
   \u4f7f\u7528\u6771\u4eac\u4f3a\u670d\u5668\u5efa\u69cb\u904a\u6232\u52a0\u901f\u5668\u9700\u8981\u4ed4\u7d30\u8003\u616e\u7db2\u8def\u67b6\u69cb\u3001\u6548\u80fd\u6700\u4f73\u5316\u548c\u6210\u672c\u7ba1\u7406\u3002\u6771\u4eac\u57fa\u790e\u8a2d\u65bd\u7684\u7b56\u7565\u512a\u52e2\uff0c\u7d50\u5408\u52a0\u901f\u6280\u8853\u548c\u76e3\u63a7\u7cfb\u7d71\u7684\u6b63\u78ba\u5be6\u65bd\uff0c\u53ef\u4ee5\u63d0\u4f9b\u5353\u8d8a\u7684\u904a\u6232\u9ad4\u9a57\u3002\u8acb\u8a18\u4f4f\u5b9a\u671f\u66f4\u65b0\u57fa\u790e\u8a2d\u65bd\u4e26\u53ca\u6642\u4e86\u89e3\u6700\u65b0\u7684\u6700\u4f73\u5316\u6280\u8853\uff0c\u4ee5\u4fdd\u6301\u904a\u6232\u52a0\u901f\u670d\u52d9\u7684\u7af6\u722d\u512a\u52e2\u3002[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
   [vc_row el_class=”blog-detail-section”][vc_ […]<\/p>\n
   Read More…<\/a><\/p>\n","protected":false},"author":1,"featured_media":27838,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8116],"tags":[9102,8159,5354,1945,1892],"class_list":["post-27841","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-japan-dedicated-server-tc","tag-bbr-acceleration","tag-japan-server-hosting-tc","tag-game-accelerator-tc","tag-network-optimization-tc","tag-server-hosting-tc"],"acf":[],"yoast_head":"\n