Changeset ad04bbc3dc5adfe3e75690b34a04448840efeffb

Timestamp:

04/18/09 12:33:01 (3 years ago)

Author:

Neutron Soutmun <neo.neutron@…>

Children:

ebf1b313a3bf00f239329f7fe3a81e40e23b0296

Parents:

ae7e7e4f3e3672207f051839f33df6649f41dca1

git-committer:

Neutron Soutmun <neo.neutron@…> (04/18/09 12:33:01)

Message:

Handle dhcp request, tune http access performance

2009-04-18 Neutron Soutmun <neo.neutron@…>

• example/{rahunas,rahunas-vserver}.conf.in, tools/firewall.sh.in:
  • Remove dhcp field from vserver config due to the dhcp request is broadcast message could not be classified which vserver it is.
  • Remove dhcp_range from vserver config which will consider later how to handle it.
  • Move the dhcp firewall code from vserver section to policy.
  • Adjust the webserver access limit rate for performance tuning.

Files:

• ChangeLog (modified) (1 diff)
• example/rahunas-vserver.conf.in (modified) (1 diff)
• example/rahunas.conf.in (modified) (1 diff)
• tools/firewall.sh.in (modified) (7 diffs)

ChangeLog

@@ +1 @@
+2009-04-18  Neutron Soutmun <neo.neutron@gmail.com>
+
+        * example/{rahunas,rahunas-vserver}.conf.in, tools/firewall.sh.in:
+          - Remove dhcp field from vserver config due to the dhcp request is broadcast
+            message could not be classified which vserver it is.
+          - Remove dhcp_range from vserver config which will consider later how to
+            handle it.
+          - Move the dhcp firewall code from vserver section to policy.
+          - Adjust the webserver access limit rate for performance tuning.
+
 2009-04-18  Neutron Soutmun <neo.neutron@gmail.com>
 

example/rahunas-vserver.conf.in

@@ -17 +17 @@
   idle_timeout = "600"
 
-  dhcp = "yes"
-  dhcp_range = "172.30.0.10 172.30.3.254"
   dns = "yes"
   ssh = "yes"

example/rahunas.conf.in

@@ -9 +9 @@
   log_file = "@localstatedir@/log/rahunas/rahunas.log"
 
+  dhcp = "yes"
+
   bandwidth_shape = "yes"  
   bittorrent_download_max = "512"

tools/firewall.sh.in

@@ -48 +48 @@
 MAIN_BITTORRENT_DOWNLOAD_MAX=`get_config_value main bittorrent_download_max $RAHUNAS_CONFIG`
 MAIN_BITTORRENT_UPLOAD_MAX=`get_config_value main bittorrent_upload_max $RAHUNAS_CONFIG`
+MAIN_DHCP=`get_config_value main dhcp $RAHUNAS_CONFIG`
 
 # Virtual Server : config
@@ -60 +61 @@
 EXCLUDED=
 BANDWIDTH_SHAPE=
-DHCP=
 DNS=
 SSH=
@@ -124 +124 @@
   EXCLUDED=`get_config_value $NAME excluded $file`
   BANDWIDTH_SHAPE=$MAIN_BANDWIDTH_SHAPE
-  DHCP=`get_config_value $NAME dhcp $file`
   DNS=`get_config_value $NAME dns $file`
   SSH=`get_config_value $NAME ssh $file`
@@ -379 +378 @@
 
   $IPTABLES -A INPUT -i lo -j ACCEPT
+
+  # DHCP Settings
+
+  if [ "$MAIN_DHCP" = "yes" ]; then
+    $IPTABLES -A INPUT -p udp --dport 67:68 -j ACCEPT 
+    $IPTABLES -A FORWARD -p udp --dport 67:68 -j DROP
+  elif [ "$MAIN_DHCP" = "no" ]; then
+    $IPTABLES -A INPUT -p udp --dport 67:68 -j DROP 
+    $IPTABLES -A FORWARD -p udp --dport 67:68 -j DROP
+  elif [ "$MAIN_DHCP" = "forward" ]; then
+    $IPTABLES -A INPUT -p udp --dport 67:68 -j DROP 
+    $IPTABLES -A FORWARD -p udp --dport 67:68 -j ACCEPT
+  fi
 }
 
@@ -388 +400 @@
 
   $IPTABLES -D INPUT -i lo -j ACCEPT
+
+  # DHCP Settings
+
+  if [ "$MAIN_DHCP" = "yes" ]; then
+    $IPTABLES -D INPUT -p udp --dport 67:68 -j ACCEPT 
+    $IPTABLES -D FORWARD -p udp --dport 67:68 -j DROP
+  elif [ "$MAIN_DHCP" = "no" ]; then
+    $IPTABLES -D INPUT -p udp --dport 67:68 -j DROP 
+    $IPTABLES -D FORWARD -p udp --dport 67:68 -j DROP
+  elif [ "$MAIN_DHCP" = "forward" ]; then
+    $IPTABLES -D INPUT -p udp --dport 67:68 -j DROP 
+    $IPTABLES -D FORWARD -p udp --dport 67:68 -j ACCEPT
+  fi
 }
 
@@ -422 +447 @@
   $IPTABLES -A $CHAIN_INPUT -p tcp -m multiport -d $VSERVER_IP\
      --dports $VSERVER_PORTS_ALLOW \
-    -m recent --rcheck --seconds 15 --name incoming_throttle -j DROP
+    -m recent --rcheck --seconds 6 --name incoming_throttle -j DROP
 
   $IPTABLES -A $CHAIN_INPUT -p tcp -m multiport -d $VSERVER_IP \
     --dports $VSERVER_PORTS_ALLOW \
-    -m hashlimit --hashlimit 5/sec \
-    --hashlimit-mode srcip --hashlimit-burst 10 \
-    --hashlimit-htable-expire 15000 --hashlimit-name incoming \
+    -m hashlimit --hashlimit 20/sec \
+    --hashlimit-mode srcip --hashlimit-burst 30 \
+    --hashlimit-htable-expire 4000 --hashlimit-name incoming \
     -j ACCEPT
 
@@ -448 +473 @@
     -d $VSERVER_IP -j ACCEPT
 
-  ##
-  # Allow incoming DHCP request
-  ##
-
-  if [ "$DHCP" = "yes" ]; then
-    $IPTABLES -A $CHAIN_INPUT -p udp --dport 67:68 -j ACCEPT 
-    $IPTABLES -A $CHAIN_FORWARD -p udp --dport 67:68 -j DROP
-  elif [ "$DHCP" = "no" ]; then
-    $IPTABLES -A $CHAIN_INPUT -p udp --dport 67:68 -j DROP 
-    $IPTABLES -A $CHAIN_FORWARD -p udp --dport 67:68 -j DROP
-  elif [ "$DHCP" = "forward" ]; then
-    $IPTABLES -A $CHAIN_INPUT -p udp --dport 67:68 -j DROP 
-    $IPTABLES -A $CHAIN_FORWARD -p udp --dport 67:68 -j ACCEPT
-  fi
+
 
   ##