From: Sten Spans Date: Tue, 30 Aug 2016 06:51:04 +0000 (+0200) Subject: remove hash signs X-Git-Tag: dnsdist-1.1.0-beta1~5^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F4379%2Fhead;p=thirdparty%2Fpdns.git remove hash signs As requested by @ahupowerdns, to make copy-pasting easier. --- diff --git a/docs/markdown/recursor/performance.md b/docs/markdown/recursor/performance.md index 22da72e361..cb935b43eb 100644 --- a/docs/markdown/recursor/performance.md +++ b/docs/markdown/recursor/performance.md @@ -22,25 +22,24 @@ To get the best out of the PowerDNS recursor, which is important if you are doin ``` ## IPv4 -# iptables -t raw -I OUTPUT -p udp --dport 53 -j CT --notrack -# iptables -t raw -I OUTPUT -p udp --sport 53 -j CT --notrack -# iptables -t raw -I PREROUTING -p udp --dport 53 -j CT --notrack -# iptables -t raw -I PREROUTING -p udp --sport 53 -j CT --notrack -# iptables -I INPUT -p udp --dport 53 -j ACCEPT -# iptables -I INPUT -p udp --sport 53 -j ACCEPT -# iptables -I OUTPUT -p udp --dport 53 -j ACCEPT -# iptables -I OUTPUT -p udp --sport 53 -j ACCEPT - +iptables -t raw -I OUTPUT -p udp --dport 53 -j CT --notrack +iptables -t raw -I OUTPUT -p udp --sport 53 -j CT --notrack +iptables -t raw -I PREROUTING -p udp --dport 53 -j CT --notrack +iptables -t raw -I PREROUTING -p udp --sport 53 -j CT --notrack +iptables -I INPUT -p udp --dport 53 -j ACCEPT +iptables -I INPUT -p udp --sport 53 -j ACCEPT +iptables -I OUTPUT -p udp --dport 53 -j ACCEPT +iptables -I OUTPUT -p udp --sport 53 -j ACCEPT ## IPv6 -# ip6tables -t raw -I OUTPUT -p udp --dport 53 -j CT --notrack -# ip6tables -t raw -I OUTPUT -p udp --sport 53 -j CT --notrack -# ip6tables -t raw -I PREROUTING -p udp --sport 53 -j CT --notrack -# ip6tables -t raw -I PREROUTING -p udp --dport 53 -j CT --notrack -# ip6tables -I INPUT -p udp --dport 53 -j ACCEPT -# ip6tables -I INPUT -p udp --sport 53 -j ACCEPT -# ip6tables -I OUTPUT -p udp --dport 53 -j ACCEPT -# ip6tables -I OUTPUT -p udp --sport 53 -j ACCEPT +ip6tables -t raw -I OUTPUT -p udp --dport 53 -j CT --notrack +ip6tables -t raw -I OUTPUT -p udp --sport 53 -j CT --notrack +ip6tables -t raw -I PREROUTING -p udp --sport 53 -j CT --notrack +ip6tables -t raw -I PREROUTING -p udp --dport 53 -j CT --notrack +ip6tables -I INPUT -p udp --dport 53 -j ACCEPT +ip6tables -I INPUT -p udp --sport 53 -j ACCEPT +ip6tables -I OUTPUT -p udp --dport 53 -j ACCEPT +ip6tables -I OUTPUT -p udp --sport 53 -j ACCEPT ``` @@ -48,24 +47,24 @@ When using FirewallD (Centos 7+ / RedHat 7+ / Fedora 21+) connection tracking ca The settings can be made permanent by using the --permanent flag. ``` ## IPv4 -# firewall-cmd --direct --add-rule ipv4 raw OUTPUT 0 -p udp --dport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv4 raw OUTPUT 0 -p udp --sport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv4 raw PREROUTING 0 -p udp --dport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv4 raw PREROUTING 0 -p udp --sport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --dport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --sport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p udp --dport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p udp --sport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv4 raw OUTPUT 0 -p udp --dport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv4 raw OUTPUT 0 -p udp --sport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv4 raw PREROUTING 0 -p udp --dport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv4 raw PREROUTING 0 -p udp --sport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --dport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp --sport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p udp --dport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -p udp --sport 53 -j ACCEPT ## IPv6 -# firewall-cmd --direct --add-rule ipv6 raw OUTPUT 0 -p udp --dport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv6 raw OUTPUT 0 -p udp --sport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv6 raw PREROUTING 0 -p udp --dport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv6 raw PREROUTING 0 -p udp --sport 53 -j CT --notrack -# firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p udp --dport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p udp --sport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -p udp --dport 53 -j ACCEPT -# firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -p udp --sport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv6 raw OUTPUT 0 -p udp --dport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv6 raw OUTPUT 0 -p udp --sport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv6 raw PREROUTING 0 -p udp --dport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv6 raw PREROUTING 0 -p udp --sport 53 -j CT --notrack +firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p udp --dport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p udp --sport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -p udp --dport 53 -j ACCEPT +firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -p udp --sport 53 -j ACCEPT ```