mirror of
https://gitee.com/callmer/pve_toss_notes.git
synced 2026-08-31 05:52:52 +08:00
更新文案描述
This commit is contained in:
CallMeR
+100
-56
@@ -109,7 +109,7 @@ $ sudo apt install qemu-guest-agent btop curl tmux logrotate cronie neovim zsh g
|
||||
$ sudo apt install unattended-upgrades powermgmt-base
|
||||
|
||||
## 安装网络工具
|
||||
$ sudo apt install nftables sshguard lsof knot-dnsutils ethtool dnsmasq conntrack
|
||||
$ sudo apt install nftables sshguard lsof knot-dnsutils ethtool dnsmasq conntrack networkd-dispatcher
|
||||
|
||||
## 安装 TS
|
||||
$ curl -fsSL https://tailscale.com/install.sh | sh
|
||||
@@ -419,9 +419,12 @@ $ sudo systemctl enable nftables.service
|
||||
$ sudo editor /etc/nftables.conf
|
||||
```
|
||||
|
||||
配置完成后，需重启 `nftables.service` 服务。
|
||||
配置完成后，先检查防火墙规则，再重启 `nftables.service` 服务。
|
||||
|
||||
```bash
|
||||
## 检查 nftables 配置文件
|
||||
$ sudo nft --check --file /etc/nftables.conf
|
||||
|
||||
## 重启 nftables.service
|
||||
$ sudo systemctl restart nftables.service
|
||||
```
|
||||
@@ -450,7 +453,7 @@ EOF
|
||||
|
||||
```bash
|
||||
## 创建 resolv.conf 软链接
|
||||
$ sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
||||
$ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
|
||||
```
|
||||
|
||||
配置完成后，需重启 `systemd-resolved.service` 服务。
|
||||
@@ -489,13 +492,9 @@ $ sudo editor /etc/dnsmasq.d/10-server-dnsmasq.conf
|
||||
在编辑器对话框中输入以下内容，并保存。
|
||||
|
||||
**额外说明：**
|
||||
|
||||
- 请根据系统内存使用情况，调整缓存参数 `cache-size`
|
||||
|
||||
- 配置文件中监听的网卡名为 `eth0` 和 `tailscale0` ，请根据实际情况进行调整
|
||||
|
||||
- 配置文件中内网域名为 `fox.internal` ，请根据实际情况进行调整
|
||||
|
||||
- `Dnsmasq` 上游 DNS 服务器分为三类，请根据实际情况进行调整
|
||||
- `server=/ts.net/100.100.100.100` ：TS 服务 `MagicDNS` 专用 DNS 服务器
|
||||
- `server=/fox.internal/172.16.1.1` ：内网域名解析 DNS 服务器，通常为主路由地址
|
||||
@@ -562,17 +561,44 @@ $ sudo systemctl restart dnsmasq.service
|
||||
|
||||
### 2.1.网卡调优
|
||||
|
||||
根据 TS 官方文档 [Performance best practices](https://tailscale.com/kb/1320/performance-best-practices) 的技术指引，优化网卡的 `rx-udp-gro-forwarding` 与 `rx-gro-list` 参数可提升 UDP 转发性能。
|
||||
根据 TS 官方文档 [Performance best practices](https://tailscale.com/docs/reference/best-practices/performance) 的技术指引，Linux 转发节点可通过调整网卡 Offload 参数提升 UDP 性能。
|
||||
|
||||
本文将使用 `ethtool` 工具并结合 `systemd` 服务提供参数自动配置方案。
|
||||
为了在网卡重新上线后自动恢复参数，本文使用 `networkd-dispatcher` 监听 `routable` 状态。
|
||||
|
||||
优化脚本直接使用事件中的 `IFACE`，仅处理由 `systemd-networkd` 配置的底层网卡，并跳过 `tailscale0` 和其他 TUN 设备。
|
||||
|
||||
首先检查 TS 服务器的底层出口网卡。
|
||||
|
||||
```bash
|
||||
## 创建 tailscale-nic-optim 脚本
|
||||
$ sudo editor /usr/local/bin/tailscale-nic-optim
|
||||
## 检查 systemd-networkd 状态
|
||||
$ systemctl is-active systemd-networkd
|
||||
|
||||
## 获取由 networkd 配置且已上线的以太网卡
|
||||
$ NETDEV=$(networkctl list --no-legend --no-pager | awk '$3 == "ether" && $4 == "routable" && $5 == "configured" {print $2; exit}')
|
||||
|
||||
## 检查网卡管理状态
|
||||
$ networkctl status "$NETDEV"
|
||||
```
|
||||
|
||||
`systemd-networkd` 应显示为 `active`，底层出口网卡应显示为 `State: routable (configured)`。
|
||||
|
||||
检查完成后，创建 `networkd-dispatcher` 的 `routable` 事件脚本。
|
||||
|
||||
```bash
|
||||
## 创建 routable 事件脚本目录
|
||||
$ sudo install -d -o root -g root -m 0755 /etc/networkd-dispatcher/routable.d
|
||||
|
||||
## 创建 TS 网卡优化脚本
|
||||
$ sudo editor /etc/networkd-dispatcher/routable.d/50-tailscale
|
||||
```
|
||||
|
||||
在脚本文件中输入以下内容，并保存。
|
||||
|
||||
**额外说明：**
|
||||
- 脚本会记录跳过、成功或失败原因，并在执行失败时保留 `ethtool` 的原始退出状态
|
||||
- `networkd-dispatcher` 会记录非零退出警告，但不会停止服务或立即重试
|
||||
- 网卡再次进入 `routable` 状态时，脚本会重新执行
|
||||
|
||||
```bash
|
||||
#!/bin/sh
|
||||
#
|
||||
@@ -580,77 +606,96 @@ $ sudo editor /usr/local/bin/tailscale-nic-optim
|
||||
# Optimize NIC offload parameters for local TS server.
|
||||
#
|
||||
|
||||
ETHTOOL_PATH=$(command -v ethtool)
|
||||
if [ -z "${IFACE:-}" ]; then
|
||||
echo "Error: IFACE is not set." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "${AdministrativeState:-}" ]; then
|
||||
echo "Error: AdministrativeState is not set for $IFACE." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$AdministrativeState" != "configured" ]; then
|
||||
echo "Skipping network device $IFACE: administrative state is $AdministrativeState."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ ! -e "/sys/class/net/$IFACE/device" ]; then
|
||||
echo "Skipping network device $IFACE: no hardware device is associated."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
ETHTOOL_PATH=$(command -v ethtool 2>/dev/null)
|
||||
|
||||
if [ -z "$ETHTOOL_PATH" ]; then
|
||||
echo "Error: ethtool command not found. Please install ethtool."
|
||||
exit 1
|
||||
echo "Error: ethtool command not found in PATH. Please install ethtool." >&2
|
||||
exit 127
|
||||
fi
|
||||
|
||||
NETDEV=$(ip route show default | awk '{for (i=1; i<=NF; i++) {if ($i == "dev") {print $(i+1); exit;}}}')
|
||||
|
||||
if [ -z "$NETDEV" ]; then
|
||||
echo "Error: Could not determine default network device using 'ip route show default'."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Configuring network device $NETDEV using $ETHTOOL_PATH for Tailscale optimizations..."
|
||||
|
||||
"$ETHTOOL_PATH" -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
|
||||
|
||||
if [ "$?" -eq 0 ]; then
|
||||
echo "Configuration successful for $NETDEV."
|
||||
exit 0
|
||||
if "$ETHTOOL_PATH" -K "$IFACE" rx-udp-gro-forwarding on rx-gro-list off; then
|
||||
echo "Configured network device $IFACE using $ETHTOOL_PATH successfully."
|
||||
else
|
||||
echo "Error: ethtool configuration failed. Check permissions or device status."
|
||||
exit 1
|
||||
exit_status=$?
|
||||
echo "Error: $ETHTOOL_PATH failed to configure network device $IFACE (exit status $exit_status)." >&2
|
||||
exit "$exit_status"
|
||||
fi
|
||||
|
||||
```
|
||||
|
||||
设置脚本可执行权限，并防止脚本被意外修改。
|
||||
`networkd-dispatcher` 仅执行属于 `root` 且具有可执行权限的脚本，执行以下命令进行设置。
|
||||
|
||||
```bash
|
||||
## 设置脚本所有者
|
||||
$ sudo chown root:root /etc/networkd-dispatcher/routable.d/50-tailscale
|
||||
|
||||
## 设置脚本可执行权限
|
||||
$ sudo chmod +x /usr/local/bin/tailscale-nic-optim
|
||||
$ sudo chmod 0755 /etc/networkd-dispatcher/routable.d/50-tailscale
|
||||
|
||||
## 设置脚本文件防篡改
|
||||
$ sudo chattr +i /usr/local/bin/tailscale-nic-optim
|
||||
$ sudo chattr +i /etc/networkd-dispatcher/routable.d/50-tailscale
|
||||
```
|
||||
|
||||
进一步创建 `tailscale-nic-optim` 服务配置文件，以满足系统自动化设置需求。
|
||||
设置完成后，手动模拟网卡事件，检查脚本能否正常应用参数。
|
||||
|
||||
```bash
|
||||
## 创建 tailscale-nic-optim.service 配置文件
|
||||
$ sudo systemctl edit --force --full tailscale-nic-optim.service
|
||||
## 测试 TS 网卡优化脚本
|
||||
$ sudo env IFACE="$NETDEV" AdministrativeState=configured /etc/networkd-dispatcher/routable.d/50-tailscale
|
||||
```
|
||||
|
||||
由于 TS 虚拟机不包含无线网卡，可通过 `systemd` 日志过滤器忽略无线工具探测信息。
|
||||
|
||||
```bash
|
||||
## 编辑 networkd-dispatcher.service 服务扩展配置
|
||||
$ sudo systemctl edit networkd-dispatcher.service
|
||||
```
|
||||
|
||||
在服务配置文件中输入以下内容，并保存。
|
||||
|
||||
```bash
|
||||
[Unit]
|
||||
Description=Tailscale NIC Offload Optimization
|
||||
ConditionVirtualization=!container
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
Before=tailscaled.service
|
||||
|
||||
```ini
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/tailscale-nic-optim
|
||||
RemainAfterExit=yes
|
||||
StandardOutput=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
LogFilterPatterns=~^No valid path found for iw(config)?$
|
||||
```
|
||||
|
||||
执行以下命令让 `tailscale-nic-optim` 服务立即启动并置为开机自启状态。
|
||||
测试通过后，启动 `networkd-dispatcher` 并设置为开机自启状态。
|
||||
|
||||
```bash
|
||||
## 设置 tailscale-nic-optim 服务开机自启
|
||||
$ sudo systemctl enable --now tailscale-nic-optim.service
|
||||
## 设置 networkd-dispatcher 开机自启
|
||||
$ sudo systemctl enable --now networkd-dispatcher.service
|
||||
|
||||
## 验证启动状态事件补发机制
|
||||
$ sudo systemctl restart networkd-dispatcher.service
|
||||
```
|
||||
|
||||
最后检查网卡优化参数。
|
||||
|
||||
```bash
|
||||
## 检查网卡优化参数
|
||||
$ sudo ethtool -k "$NETDEV" | grep -E 'rx-udp-gro-forwarding|rx-gro-list'
|
||||
|
||||
#### ethtool 示例输出
|
||||
rx-gro-list: off
|
||||
rx-udp-gro-forwarding: on
|
||||
```
|
||||
|
||||
### 2.2.启动模式
|
||||
@@ -675,7 +720,6 @@ $ sudo tailscale up --advertise-exit-node --accept-dns=false --reset
|
||||
若需 TS 提供内网路由功能并能访问内网私有服务，执行以下命令。
|
||||
|
||||
**额外说明：**
|
||||
|
||||
- 请根据内网网段，调整 TS 内网路由参数 `advertise-routes`
|
||||
|
||||
```bash
|
||||
|
||||
Reference in New Issue
Block a user