为什么Gateway会主动关闭客户端?

JoeZing

这是我的配置:

'count'                => 10, //进程数
'startPort'            => 2800, //开始端口
'pingInterval'         => 60, //心跳包间隔时间
'pingNotResponseLimit' => 3,
'pingData'             => '{"action":"ping"}'

现在有这种症状,Gateway发了3个心跳包后,客户端就被关闭了,一直找不出是什么原因,尝试把60秒改为25秒也是一样,可以肯定的是客户端没有主动断开连接。

阅读 3674
7个回答

walkor

pingNotResponseLimit 改成0试下。

  • JoeZing 2017-01-06

    我直接把防火墙关闭后就不会出现这种情况。

  • JoeZing 2017-01-06

    能否指点下排除问题的思路?

JoeZing

防火墙配置如下,不知道是否会受什么影响:

:INPUT DROP 
:FORWARD ACCEPT 
:OUTPUT ACCEPT 
:syn-flood - 
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8383 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2800:2810 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1239 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m limit --limit 100/sec --limit-burst 100 -j ACCEPT
-A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn-flood
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A syn-flood -p tcp -m limit --limit 3/sec --limit-burst 6 -j RETURN
-A syn-flood -j REJECT --reject-with icmp-port-unreachable
COMMIT

第二张图是 ulimit -a

  • 暂无评论
walkor

pingInterval 时间太长了,链接长时间空闲被防火墙关闭了,改成30秒

  • JoeZing 2017-01-06

    25秒也是一样

  • JoeZing 2017-01-06

    实在是抓破头脑,想不出哪里出问题。

JoeZing

@walkor 有其他可以解决问题的思路么

  • 暂无评论
walkor

运行
sysctl -a| grep netfilter
结果贴下

  • JoeZing 2017-01-07

    见下面,有空麻烦看看

JoeZing

@walkor

有问题的服务器:

net.netfilter.nf_log.0 = NONE
net.netfilter.nf_log.1 = NONE
net.netfilter.nf_log.2 = NONE
net.netfilter.nf_log.3 = NONE
net.netfilter.nf_log.4 = NONE
net.netfilter.nf_log.5 = NONE
net.netfilter.nf_log.6 = NONE
net.netfilter.nf_log.7 = NONE
net.netfilter.nf_log.8 = NONE
net.netfilter.nf_log.9 = NONE
net.netfilter.nf_log.10 = NONE
net.netfilter.nf_log.11 = NONE
net.netfilter.nf_log.12 = NONE

另外一台没有问题的服务器:环境一样,区别那么多?

net.netfilter.nf_log.0 = NONE
net.netfilter.nf_log.1 = NONE
net.netfilter.nf_log.2 = NONE
net.netfilter.nf_log.3 = NONE
net.netfilter.nf_log.4 = NONE
net.netfilter.nf_log.5 = NONE
net.netfilter.nf_log.6 = NONE
net.netfilter.nf_log.7 = NONE
net.netfilter.nf_log.8 = NONE
net.netfilter.nf_log.9 = NONE
net.netfilter.nf_log.10 = NONE
net.netfilter.nf_log.11 = NONE
net.netfilter.nf_log.12 = NONE
net.netfilter.nf_conntrack_generic_timeout = 600
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 432000
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
net.netfilter.nf_conntrack_tcp_loose = 1
net.netfilter.nf_conntrack_tcp_be_liberal = 0
net.netfilter.nf_conntrack_tcp_max_retrans = 3
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 180
net.netfilter.nf_conntrack_icmp_timeout = 30
net.netfilter.nf_conntrack_acct = 0
net.netfilter.nf_conntrack_events = 1
net.netfilter.nf_conntrack_events_retry_timeout = 15
net.netfilter.nf_conntrack_max = 65536
net.netfilter.nf_conntrack_count = 6470
net.netfilter.nf_conntrack_buckets = 16384
net.netfilter.nf_conntrack_checksum = 1
net.netfilter.nf_conntrack_log_invalid = 0
net.netfilter.nf_conntrack_expect_max = 256
  • 暂无评论
walkor

可能是这台服务器防火墙配置的有问题,找你们运维看下吧

  • 暂无评论