设置pptpd与apf

ccp

用SNAT还是用MASQUERADE好？

1. Masquerading should be used where you have a dynamic connection and the IP address is likely to change (maybe on ppp0). That way masquerading just picks up the new dynamic IP and uses that to change addresses.
   
2. 
   
3. SNAT has some connection tracking advantages where if your link goes down for a short while, it will remember the connections that are still open/active and continue on when the link returns (depending on timeouts etc..). Masq does not, it clears the state each time it comes up as a saveguard.

复制代码

SNAT效率高哦。

eudx

不懂这个的用途。是所有访问都从虚拟网卡进来么？
那怎么防攻击的呢？
比如单个IP的WEB压力测试 具体怎么用APF阻止啊

诡谲

比较有效率.

诡谲

貌似SNAT比较好.但是我经常遇到ip_conntrack被塞满的情况.然后网络停止反应.也ping不通了.

出错信息如下.但是我的表已经设置很大了.
ip_conntrack: table full, dropping packet.
ip_conntrack: table full, dropping packet.
ip_conntrack: table full, dropping packet.
ip_conntrack: table full, dropping packet.
ip_conntrack: table full, dropping packet.