iptables

防火墙 逻辑上，防火墙可以分为主机防火墙和网络防火墙。主机防火墙针对单个主机进行防护；网络防火墙往往处于网络入口或者边缘，针对网络入口进行防护，服务于防火墙背后的本地局域网。 物理上，防火墙可以分为硬件防火墙和软件防火墙。硬件防火墙在硬件级别实现部分防火墙功能，另一部分基于软件实现，性能高，成本高；软件防火墙应用软件处理逻辑运行于通用计算平台之上的防火墙，性能低，成本低。 iptables/netfilter iptables其实不是真正的防火墙，可以把它理解陈伟一个客户端代理，用户通过iptables这个代理，将用户的安全设定执行到对应的“安全框架”中，这个“安全框架”才是真正的防火墙， 这个框架的名字叫netfilter。 netfilter才是防火墙真正的安全框架，位于内核空间。iptables其实是一个命令行工具， 位于用户空间，我们使用iptables这个工具操作真正的框架netfilter。 netfilter/iptables组成的linux平台下的包过滤防火墙，是免费的，具有以下功能： 网络地址转换(NAT, Network Address Translate) 数据包内容修改 数据包过滤(防火墙功能) 我们虽然可以使用service iptables start启用iptables服务，但其实准确的来说iptables并没有一个守护进程，不能算是真正意义上的服务，而算是内核提供的功能。 iptables是按照规则(rules)来办事的, rules 就是我们预定义的条件。规则一般定义为“如果数据包头符合这样的条件，就这样处理这个数据包”。规则存储在内核空间的信息包过滤表中。这些规则分别指定了源地址、目的地址、传输协议(如TCP、UDP、ICMP)和服务类型(如HTTP、FTP和SMTP)等。当数据包与规则匹配时，iptables就根据规则所定义的方法来处理这些数据包， 如放行(accept)、拒绝(reject)和丢弃(drop)等。配置防火墙主要工作就是添加、修改和删除这些规则。 ewctl hubDevice Objcet true 默认hub

Linux Network Command

nc Netcat(or nc) is a command-line utility that reads and write data across network connections, using the TCP or UDP protocols. It is one of the most powerful tools in the network and system administrators arsenal, and it as considered as a Swiss army knife of networking tools. Netcat is cross-platform, and it’s available for Linux, macOS, Windows , and BSD. You can use Netcat to debug and monitor network connections, scan for open ports, transfer data, as a proxy and more.

Linux socket

Internet domain socket Unix domain socket You can forward the unix domain socket with the -R option of the ssh command. 1ssh -R remote_socket:local_socket https://github.com/nikhilroxtomar/Multiple-Client-Server-Program-in-C-using-fork

Make

The marker - means ignore the err of this line command @ only prints the result of command.

OpenVPN Setup

Configuration Server side Server.conf 1# /etc/openvpn/server/server.conf 2local 10.0.0.230 3port 1194 4proto udp 5dev tun 6ca ca.crt 7cert server.crt 8key server.key 9dh dh.pem 10auth SHA512 11tls-crypt tc.key 12topology subnet 13client-config-dir /etc/openvpn/ccd # bind ip with client name 14route 192.166.0.0 255.255.255.0 # route add to server side 15push "route 192.167.0.0 255.255.255.0" # route add to client side 16server 10.8.0.0 255.255.255.0 17push "redirect-gateway def1 bypass-dhcp" 18ifconfig-pool-persist ipp.txt 19push "dhcp-option DNS 10.0.0.1" 20keepalive 10 120 21cipher AES-256-CBC 22user nobody 23group nogroup 24persist-key 25persist-tun 26verb 4 # log level, 1-11, bigger more details 27crl-verify crl.

Performance profiling

Linux Performance Counter Hardware Event CPU Performance Monitor Unit Instruction retired Processor clock cycles Cache Software Event Software counter/tracepoint Page fault process context Tracepints is the hook in the Linux kernel. 在特定代码执行的时候会被触发。 1ls /sys/kernel/debug/tracing/events  If the machine not a baremetal, it can’t collect hardware event. For example in a esxi VM. Request LLC-load-misses Instructions Cycles The ODMS containes now: Dashboard consists of 12 panels based on following metrics:

VPC

What is VLAN and Virtual Network Interface

In our day-to-day life, we have seen LAN and WAN architectures mostly because we have to deal with only one IP address on one interface. We either connect our system with LAN cable or with WiFi. In this article, we will discuss the VLAN and how to create the VLAN on the Ubuntu server, but let first understand what is VLAN and why we use VLAN. What is VLAN Virtual Local Area Network(VLAN) is a logical concept of breaking large broadcast domains into small domains.

What is VXLAN