以前经常看有人推荐呗。。。

这个测试很多 kb/s 传输的线路，也是速度由低到高，由高到低，反复循环。这下放心了不是服务器设置的问题，看起来是哪里有什么限制，效果跟 iptables limit 差不多。

终于看到那家 hostus 了。。。比搬瓦工都不如，小带宽机器明显做了各种限制。

被墙了呗。。。手里的 vps 一经过广州电信的时候，早上 3 台两台可连，下午就只剩下一台了。 l2tp 端口太固定了，如果没特别需要可以考虑 ocserv ，端口随意指定。
也就这段时间吧，以前我记得 l2tp 没这么难连的，用搬瓦工的基本是 100%的，现在失败的情况时常发生，一直在走广州，看起来没希望走回上海了。。。

以前研究 routeros 的时候研究了一下小包， ros 竟然不支持 tc 。网上的小包都是 iptables -t mangle -A QOSDOWN -m length --length 256: -j GAME_BURST

其实 tomato 里是这样的
#$TC filter add dev $UDEV parent 1:0 prio 12 protocol arp handle 1 fw classid 1:20 # Arp traffic
$TC filter add dev $UDEV parent 1: prio 13 protocol ip u32 match ip protocol 1 0xff flowid 1:20 #ICMP
#$TC filter add dev $UDEV parent 1: prio 14 protocol ip u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:20 #ACK
$TC filter add dev $UDEV parent 1: prio 15 protocol ip u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x02 0x02 at 33 flowid 1:20 #SYN
#$TC filter add dev $UDEV parent 1: prio 17 protocol ip u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x01 0x01 at 33 flowid 1:20 #FIN
#$TC filter add dev $UDEV parent 1: prio 19 protocol ip u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x04 0x04 at 33 flowid 1:20 #RST

不会抓包，无法分析孰优孰劣。

目前能用的最简单的就是根据访问目的端口分级，这个以前已经被一个朋友批判过了。。。他用的是一种商业流控模块，类似 l7 之类的东东，对各种数据流进行分级，然后打上 DSCP 标记，再根据 DSCP 标记来分流。

上次做 vpn 分流时，倒发现一种方法蛮好的，其实大家都在做，找一个国内的 100mbps 上行服务器，然后受限资源通过 vpn 连接 cn2 服务器，在国内的服务器上做策略路由，这样也可以用一些便宜的线路分流一下。

日本的，这会儿又正常了。。。

上次我姑父在医院说的时候我也告诉他先试试用和盐一起刷，结果一看医生就变成拨牙了。。。盐有效果的，可以先刷个几天，不行再拨吧。盐应该有消炎止痛的效果，医院的很多点滴还叫 盐水 呢。

试试，搞点盐上去刷。人太累也容易表现在牙齿上。

conoha z.com 的 dns 都是比较怪的，说不出来的问题在哪，比如使用 google 显示的是上海 广州，也不知道用了什么黑科技，最终发现使用 8.8.x.x 也是有问题的，干脆就使用美国的 dns 服务器。自己 apt-get install dnsmasq ，然后 vi /etc/dnsmasq.conf,service dnsmasq restart 就差不多了。检验 nslookup fonts.googleapis.com ，如果不成功可以尝试 vi /etc/resolv.conf 写入 nameserver 127.0.0.1 ，给 chattr +i /etc/resolv.conf,取消只读 chattr -i /etc/resolv.conf


dnsmasq.conf
#no-resolv
server=4.2.2.1
server=4.2.2.2
#server=8.8.4.4
#server=8.8.8.8
#address=/fonts.googleapis.com/74.125.196.95
server=/fonts.googleapis.com/4.2.2.1

嘿嘿，搬瓦工 vs vultr ，丢包丢得你不想用,vultr 家的不知道是自身问题还是。。。这丢包还有什么速度，连接时都是各种出错。。。

http://ww4.sinaimg.cn/large/0060lm7Tgw1ez4vqkdyiwj311s0m546g.jpg

3 台了， 4.9T 的流量，一个人一个月用不了 100G 。

ufw 是谁造的轮子，虽然规则读起来很有语义还不如直接掌握 iptables 。
以前
iptables -P INPUT ACCEPT
iptables -A INPUT -j DROP #一直以为这句 DROP 所有连接，
一年后才发现根本没用，还是得默认 iptables -P INPUT DROP 才是真正的丢弃所有未允许的服务。
习惯用 iptables-save iptables-restore iptables -S INPUT 多熟悉一下常用防火墙结构也就那三两句。

晚上 21 ： 14 分的。。。为什么什么样的 vps 都没什么惊喜，也许还没入电信黑名单吧。。。这还是锐速加速过后的。。。

http://ww2.sinaimg.cn/large/0060lm7Tgw1ez44g16mtsj30nf0dg0uk.jpg

哎，中国的网络管制真是无法无天，从中间两边断开。太他妈无法无天了，还天天依法制国，制你妹。

服务器端。。。。

2015.12.18 10:59:49 LOG3[20]: SSL_accept: Peer suddenly disconnected
2015.12.18 11:01:04 LOG3[21]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:09 LOG3[12]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:11 LOG3[15]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:11 LOG3[17]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:11 LOG3[18]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:11 LOG3[14]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:01:50 LOG3[23]: SSL_accept: Peer suddenly disconnected
2015.12.18 11:01:50 LOG3[24]: SSL_accept: Peer suddenly disconnected
2015.12.18 11:06:16 LOG3[32]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:16 LOG3[34]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:17 LOG3[33]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:17 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:17 LOG3[28]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:17 LOG3[31]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:06:34 LOG3[56]: SSL_accept: Peer suddenly disconnected
2015.12.18 11:07:58 LOG3[50]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:07:58 LOG3[52]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:07:59 LOG3[53]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:22 LOG3[60]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:22 LOG3[65]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:39 LOG3[61]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:54 LOG3[66]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:55 LOG3[76]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:10:56 LOG3[78]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:11:55 LOG3[74]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:19:30 LOG4[ui]: Insecure file permissions on /da/ca/stunnel.pem
2015.12.18 11:21:08 LOG4[ui]: Insecure file permissions on /da/ca/stunnel.pem
2015.12.18 11:24:25 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:31 LOG3[29]: Unexpected socket close (s_ssl_read)
2015.12.18 11:24:57 LOG3[5]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:57 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:57 LOG3[6]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:57 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:58 LOG3[4]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:24:59 LOG3[3]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:25:01 LOG3[7]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:25:27 LOG3[11]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:25:28 LOG3[12]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:26:27 LOG3[18]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:26:27 LOG3[19]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:26:29 LOG3[28]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:26:33 LOG3[15]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:26:34 LOG3[30]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:27:39 LOG3[31]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:07 LOG3[43]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:07 LOG3[38]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:07 LOG3[42]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:26 LOG3[44]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:46 LOG3[46]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:46 LOG3[48]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:46 LOG3[50]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:46 LOG3[49]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:28:55 LOG3[51]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:29:15 LOG3[55]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:29:30 LOG3[60]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:29:30 LOG3[59]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:33:32 LOG3[63]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:34:56 LOG3[64]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:34:56 LOG3[67]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:34:56 LOG3[70]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:34:56 LOG3[71]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:34:57 LOG3[66]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:01 LOG3[68]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:02 LOG3[72]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:07 LOG3[69]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:38 LOG3[86]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:42 LOG3[91]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:35:43 LOG3[74]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:36:17 LOG3[81]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:36:26 LOG3[79]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:36:26 LOG3[92]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:36:26 LOG3[77]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:36:41 LOG3[96]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:37:01 LOG3[102]: s_connect: s_poll_wait 23.251.96.136:80: TIMEOUTconnect exceeded
2015.12.18 11:37:02 LOG3[103]: s_connect: s_poll_wait 23.251.96.136:80: TIMEOUTconnect exceeded
2015.12.18 11:37:03 LOG3[104]: s_connect: s_poll_wait 23.251.96.136:80: TIMEOUTconnect exceeded
2015.12.18 11:38:24 LOG3[114]: Unexpected socket close (s_ssl_read)
2015.12.18 11:38:54 LOG3[106]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:38:55 LOG3[108]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:38:55 LOG3[107]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:38:57 LOG3[109]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:39:01 LOG3[105]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:39:01 LOG3[102]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:39:02 LOG3[103]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing
2015.12.18 11:39:42 LOG3[101]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing

嘿嘿，我可以说别高兴太早，苦日子还在后头吗。。。这个服务器我还一个月都没试用完了。今天先是体验到 1000mbps 的情况，然后今天好像倒霉的就是测试了一下 softether vpn client ，结果现在成这样了，这是这段时间的最恐怖体验，已经基本不可用状态。。。。。。。。。。。。。

哎，真的别高兴太早，我以前推荐的时候，别的朋友就说很慢，现在轮到我说慢了，垃圾电信。

2015.12.18 19:35:44 LOG3[291]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[291]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[295]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[295]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[297]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[297]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[299]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG3[293]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[299]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG5[293]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[290]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[290]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[292]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[292]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[296]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[296]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[298]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[298]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[300]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[300]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG3[294]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:44 LOG5[294]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:44 LOG5[301]: Service [server6] accepted connection from 127.0.0.1:9127
2015.12.18 19:35:44 LOG6[301]: s_connect: connecting xxx.xxx.xxx.xxx:80
2015.12.18 19:35:48 LOG6[288]: Read socket closed (readsocket)
2015.12.18 19:35:48 LOG6[288]: SSL_shutdown successfully sent close_notify alert
2015.12.18 19:35:48 LOG5[288]: Connection closed: 529 byte(s) sent to SSL, 185807 byte(s) sent to socket
2015.12.18 19:35:54 LOG3[301]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:35:54 LOG5[301]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:35:54 LOG5[302]: Service [server6] accepted connection from 127.0.0.1:9129
2015.12.18 19:35:54 LOG6[302]: s_connect: connecting xxx.xxx.xxx.xxx:80
2015.12.18 19:36:04 LOG3[302]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:80: TIMEOUTconnect exceeded
2015.12.18 19:36:04 LOG5[302]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2015.12.18 19:36:04 LOG5[303]: Service [server6] accepted connection from 127.0.0.1:9131

iptables 计数并不准确的，这个计数就是用 tcpping 都能让它增加计数。其实都按量了，完全可以用 iptables knock door 方法，必要时敲开防火墙端口，平时屏蔽所有访问，这样流量就省了。

能翻你再想想那可怜的 100kb/s ， 100kb 哦，用惯国外的大水管，再用回这种小水管受不了。又贵又烂，话说家里也有 140kb/s 上行， openwrt 都可以支撑各种 web vpn proxy 了。

先把这两篇基础的搞定，对 softether 就有个大概的了解。不懂为什么 softether 外面又有一层 socks 连接。如果用 vpn ，你原先的环境就要变化，按现在的设想是有个网关设备，统一将不同的代理服务器连接到本地虚拟机操作系统里的虚拟接口 soft soft1 soft2 soft3 ，然后用策略路由#ip rule add from 192.168.50.0/24 table outwall prio 1 或者干脆把相应的接口直接安装到特定的虚拟机里，原则上 xp 也是没问题的，太古董了没操作过。。。 linux ip route 策略路由不怎么熟悉，大体是这样。 softether 我已经好久没在国内网络用过了，担心穿墙时是否会被挡。

Softether on VPS Using Local Bridge
http://blog.lincoln.hk/blog/2013/05/17/softether-on-vps-using-local-bridge/
Build a LAN-to-LAN VPN (Using L3 IP Routing)
https://www.softether.org/4-docs/1-manual/A._Examples_of_Building_VPN_Networks/10.6_Build_a_LAN-to-LAN_VPN_(Using_L3_IP_Routing)