Ngabe i-VPN gateway yakho iboshwe i-CPU? Funda kuqala umthwalo wekhozi ngalinye

Nquma ukuthi iyiphi yemikhawulo emithathu oyifinyelele ngaphambi kokuthenga isimo esikhudlwana. Ikhozi elilodwa eligcwele ngenkathi amanye engenzi lutho likhombisa umsebenzi we-crypto ngokugeleza. Wonke amakhozi egcwele ngesikhathi sokudlulisa akhombisa umthamo uwonke. I-CPU ephansi kanye nenani elikhulayo lokudlulisa kabusha likhombisa indlela. Ngayinye inesinyathelo sokuqala esihlukile, futhi eyodwa kuphela ixazululwa isimo esikhudlwana.

Imikhawulo emithathu, ithebula elilodwa, izilungiso ezintathu

Funda imigqa njengezinto zokuxilonga, hhayi njengezigaba. Intambo eyodwa ku-100% ngenkathi ezinye zingenzi lutho iwumphumela ojwayelekile kakhulu ku-gateway ethwala umhubhe omkhulu owodwa, ngoba ukubethela kwalokho kugeleza kusebenza kukhozi olulodwa. Wonke amakhozi ematasa ngesikhathi sokudlulisa kusho ukuthi umshini usuwenza umsebenzi omningi kangako. I-CPU ephansi kanye nokudlulisa kabusha okukhulayo kusho ukuthi iprosesa ilinde inethiwekhi elahla idatha njalo.

Zilungise ngokulandelana kobufakazi. Ukusabalalisa ukugeleza kubasebenzi kusiza icala lokuqala futhi akwenzi lutho kwelesibili. Isimo esikhudlwana sisiza elesibili futhi sichitha imali kwelokuqala. Ukulungiswa kwe-MTU noma ukulahleka kungukuphela okuthinta elesithathu. Ukuthenga umthamo ngaphambi kokwazi ukuthi ukumugqa upi inguqulo ebizayo yokuqagela.

Hlukanisa intambo eboshiwe kusuka kusihambisi esimatasa

Qala ngokusetshenziswa kwekhozi ngalinye, ukuze ikhozi elilodwa eliboshiwe lingakwazi ukucasha phakathi kwesilinganiso. Ukugijima okukodwa ngesikhathi sokudlulisa kubonisa ukuthi umthwalo uyisicaba noma unamaqongo. Zombili izimo zinikeza ulwazi, futhi iphrofayela enamaqongo ivamise ukusho ukuthi iwindi lokusampula libambe umsebenzi wesihleli hhayi ukubethela.

mpstat -P ALL 1 5

Yabela ikhozi elimatasa iphrosesa, bese kuba intambo. Ukugijima kokulandela ngezansi kugcina intambo yomzali neyingane ndawonye, okubalulekile lapho i-daemon ihlukana ngakunye ukuxhumana:

pidstat -u -t -p $(pgrep -f 'openvpn|wireguard|ipsec') 1 10

I-crypto ye-kernel ayiveli neze kusibali sephrosesa yendawo yomsebenzisi. Sampula izintambo ngokwehlukana futhi uqhathanise lowo mbono nokubalwa kwephrosesa:

top -H -b -n 1 | head -20

Funda izibali ze-socket ekugcineni, ngoba zinquma ukuthi i-CPU eyengeziwe izosiza nhlobo yini. Ukudlulisa kabusha okukhuphukayo ngenkathi i-CPU isicaba akuyona inkinga yeprosesa. Gcina ukudlulisa kugijima ngenkathi usampula, kungenjalo izinombolo zizochaza umshini ongenzi lutho:

ss -ti | grep -E 'retrans|cwnd|rtt'

Ukudlulisa okulawulwayo, kugijinywa kabili

Izibali ezingenzi lutho azifakazi lutho, futhi ukuhlola ngokumelene nendawo yokugcina engahleliwe kufakaza okuncane kakhulu. Khetha iklayenti elilodwa, indawo eyodwa kanye nokudlulisa okumelayo okukodwa okuvunyelwe ukukugijimisa, bese urekhoda ukudlula kanye nokubambezeleka kokusebenzisana efasiteleni elilodwa. I-gateway ingagcwala ngenkathi ikhophi enkulu isaqeda, futhi ijika lokubambezeleka yilokho abasebenzisi abakuzwa ngempela. Bhala ukudlulisa, inani lamaklayenti kanye nenguqulo ye-daemon eceleni kwezinombolo.

Phinda ukugijima nokugeleza okuningi okuhambisana. Ukukhula kukho konke ukugeleza kukhombisa amawindi ngakunye ukugeleza; ukuhlala kusicaba ngekhozi elilodwa eliboshiwe kukhombisa ukucutshungulwa.

Bese uphinda futhi ngemithwalo yomsebenzi yokuzikhethela emisiwe. Ikhopi lokusekela, isithumeli samarekhodi noma isizindalwazi kusihambisi esifanayo kungakhiqiza isilinganiso esimatasa esingahlobene ngalutho nemihubhe. Uma i-CPU isaboshiwe ngenkathi isihambisi sithule ngenye indlela, ubufakazi bukhomba iphrosesa ye-VPN. Uma yehla, ubukala umakhelwane, futhi i-gateway yayingeyona inkinga neze.

Susa indlela ngaphambi kokuthenga ihadiwe

Ukudlulisa kabusha okukhulayo, iwindi lokuminyana elinciphayo kanye nesikhathi sokuhamba nokubuya esikhulayo konke kukhombisa kude neprosesa. Qhathanisa i-MTU yomhubhe ne-MTU yendlela, hlola isixhumanisi esingaphansi ngokulahleka, futhi uqinisekise ukuthi i-uplink yeklayenti uqobo ayiyona umkhawulo. I-gateway enkudlwana ayilungisi isixhumanisi esilahla amaphakethe, futhi abasebenzisi bachaza zombili iziphambeko ngamagama afanayo. Isibali sokudlulisa kabusha sizihlukanisa ngemizuzu.

Kuseva ebonakalayo, engeza izilinganiso zomhlinzeki kulezo zesivakashi. Isikhathi esintshiwe yindlela okuthengiswa ngokweqile okubonakala ngayo ngaphakathi kwesivakashi, futhi akukho kulungiswa ngaphakathi kwesivakashi okukususayo. Izibali zesivakashi azikwazi ukubona isihambisi, ngakho igrafu ehlanzekile yesivakashi ayibona ubufakazi besihambisi esinempilo.

Ushintsho olulodwa, isilinganiso esisodwa

Khetha umqagelo okusekelwa ubufakazi, bese ushintsha isilungiselelo esisodwa esisekelwe: inani labasebenzi, inketho yokwehlisa umthwalo ebhaliwe, noma usayizi wesimo. I-OpenVPN ishicilela umhlahlandlela wokuxazulula izinkinga zokusebenza mayelana nokuhlukaniswa okufanayo phakathi kokucutshungulwa nokuthuthwa: Ukuxazulula izinkinga zokusebenza kwe-OpenVPN.

Qinisekisa ukuthi inketho yokwehlisa umthwalo isebenza ngempela esikhundleni sokwethemba ifulegi, bese ugijima futhi ukudlulisa okufanayo futhi uqhathanise okufanayo nokufanayo. Yilokho kuphela indlela yokuhlukanisa ukuthuthuka kwangempela ntambama ethule. Gcina iphoyinti lokuhlola ongakubuyisela, ngoba kushintsho lwesibili abantu balahlekelwa ukulandelela ukuthi yikuphi okwasiza. Ukuguquguquka okukodwa ekugijimeni ngakunye kuhamba kancane usuku olulodwa futhi kushesha inyanga eyodwa.

Unganciphisi ukuqinisekisa noma isethi yezinhlamvu ukuze igrafu ibukeke kangcono. Uma i-CPU ingakalandeli uphawu, buyela ekuhlolweni kwendlela nohlelo esikhundleni sokuthuthukisa ngokuqagela.