Depois de pesquisar no Google, posso resolver isso.
- O acesso lento a arquivos compartilhados com SMB no controlador de domínio no Windows Server 2012 R2 é porque o GPO de redirecionamento de pasta faz alterações nas permissões na pasta de perfil do usuário durante o processo de redirecionamento quando a pasta não existe no destino. Baseado no iamrafic da Microsfot Technet ( link ), precisamos alterar as permissões de pasta para isso:
Create the folder in the required location Disable inheritance of permissions from the parent and remove all inherited permissions by clicking the appropriate button. One entry will already be in the DACL: Local Administrators.
Alter Local Administrators: Full Control: This folder, subfolders and files
Add SYSTEM: Full Control: This folder, subfolder and files.
Add CREATOR OWNER: Full Control: This folder, subfolders and files.
Add Authenticated Users: List folder / read data, Create folders / append data: This folder only
Add Domain Admins: Full Control: This folder, subfolders and files.
Click OK.
- O outro problema foram as regras do iptables, eu precisei executar uma cadeia completa e consertar a ordem para cada regra FORWARD, porque isso altera o desempenho quando o pacote é analisado. Aqui os novos.
#!/bin/sh
#Flushing all rules
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -t raw -F
# Basic tables
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
#
iptables -A FORWARD -o virbr32 -s 192.168.1.0/24 -d 192.168.100.0/28 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i virbr32 -s 192.168.100.0/28 -d 192.168.1.0/24 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o virbr32 -i br0 -j ACCEPT
iptables -A FORWARD -i virbr32 -s 192.168.100.0/2 -j ACCEPT
iptables -A FORWARD -i virbr32 -o virbr32 -j ACCEPT
iptables -A FORWARD -i virbr32 -j LOG --log-prefix "iptables-FORWARD-REJECT: "
iptables -A FORWARD -i virbr32 -j REJECT --reject-with icmp-port-unreachable
# Masquerade local subnet
iptables -t nat -A POSTROUTING -s 192.168.100.0/28 -j MASQUERADE
# Do not masquerade to these reserved address blocks.
iptables -t nat -A POSTROUTING -s 192.168.100.0/28 -d 224.0.0.0/24 -j RETURN
iptables -t nat -A POSTROUTING -s 192.168.100.0/28 -d 255.255.255.255/32 -j RETURN
# SMB
# RPC EPM TCP 135
# RPC over HTTPS TCP 593
# SMB (for named pipes) TCP 445
# Ephemeral Range, Dynamic *
iptables -I FORWARD 6 -o virbr32 -i br0 -m conntrack --ctstate NEW -p tcp -d 192.168.100.12 --dport 445 -j ACCEPT
iptables -I FORWARD 7 -o virbr32 -i br0 -m conntrack --ctstate NEW -p tcp -d 192.168.100.12 --dport 139 -j ACCEPT
# Accept DNS (port 53) and DHCP (port 67) packets from VMs.
iptables -I FORWARD 8 -o virbr32 -i br0 -m conntrack --ctstate NEW -p tcp -m tcp -m multiport --dports 53,67 -j ACCEPT
iptables -I FORWARD 9 -i virbr32 -o br0 -m conntrack --ctstate NEW -p udp -m udp -m multiport --dports 53,67 -j ACCEPT
#
#
# The two rules below assure that only TCP packets get examined. All others
# continue into the *filter table.
iptables -t raw -N TCPFLAGS
iptables -t raw -A PREROUTING -p tcp -j TCPFLAGS
iptables -t raw -A PREROUTING -j ACCEPT
# Quickly accept standard handshakes
# ALLOW ACK or ACK/SYN
#-A TCPFLAGS -j ACCEPT
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags FIN,ACK,URG,PSH,RST ACK -j ACCEPT
# Allow ACK/FIN with either URG or PSH, or both, or neither
# but SYN and RST can't be set
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags FIN,SYN,ACK,RST ACK,FIN -j ACCEPT
# Allow SYN or ACK/SYN
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags FIN,SYN,URG,PSH,RST SYN -j ACCEPT
# Allow RST or ACK/RST
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags FIN,SYN,URG,PSH,RST RST -j ACCEPT
# This rule catches xmas-tree and fin attacks
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags FIN FIN -j DROP
# This rule catches xmas-tree and syn/rst attacks
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags SYN SYN -j DROP
# This rule catches null attacks
iptables -t raw -A TCPFLAGS -p tcp --tcp-flags ALL NONE -j DROP
#-A TCPFLAGS -p tcp -ecn-tcp-cwr -j DROP
# these rules catch bad ack combinations
#-A TCPFLAGS -p tcp --tcp-flags ACK ACK -j ACC
#iptables -t raw -A TCPFLAGS -j ACCEPT
# So, what do we accept for tcp?
# handshakes (ACK/FIN), (ACK/SYN), (SYN), (ACK), (RST), (ACK/RST),
# and data packets with PSH or URG or FIN or ACK
#
#Log packets droped
iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
iptables -A FORWARD -m limit --limit 2/min -j LOG --log-prefix "IPTables-FWD-Dropped: " --log-level 4
iptables -A OUTPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4
- Como você pode ver, usei iptables -I FORWARD em vez de iptables -A FORWARD porque com isso posso executar uma ordenação de regras na minha tabela de filtros colocando primeiro as regras mais importantes e depois vai mais fundo depois de DROP ou negar o resto. Todas as regras FORWARD vão antes desta linha
iptables -A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
Editar : Eu só preciso fazer algumas alterações para ter mais taxa de transferência quando copiar arquivos da VM para o exterior na lan 192.168.1.0/24, eu não posso levar mais de 4Mb / s. Qualquer conselho será apreciado !!