EoIP bisa hanyar VPN ta LTE: gina ƙaramin dakin gwaji na RouterOS

EoIP yana ɗaukar cikakken firam na Ethernet, yana naɗe shi cikin GRE sannan yana aika shi zuwa wani adireshin nesa da aka saita, shi ya sa sakamakon yake aiki kamar kebul maimakon kamar hanya. Abin da ke fita daga na'urar sadarwa shi ne ka'idar IP lamba 47 tare da ainihin firam ɗin a matsayin kaya, don haka watsa-baki, ARP da ka'idojin da ba na IP ba duk suna wucewa. GRE ba ya ƙara wata ɓoyayya ta kansa, kuma firam ɗin yana ci gaba da kasancewa abin karantawa ga duk abin da zai iya ganin fakitin waje. Wannan gaskiya ɗaya ce ke ƙayyade tsarin wannan dakin gwaji: fara gina hanyar da aka ɓoye, sannan ka ɗauki Ethernet a cikinta.

Abin da EoIP ke naɗewa, da abin da ba ya naɗewa

Naɗewar ita ce duk hanyar. Firam yana isowa a tashar da ke cikin gada, yana samun kan GRE da kan IP na waje, sannan ana kai shi ga na'urar sadarwa takwara, wadda ke cire duka biyun sannan ta shigar da firam ɗin cikin gadarta. Gadan da ke karɓa tana koyon MAC na asali kamar yadda za ta koya daga tasha ta gida. Babu wani abu a cikin wannan tsari da ke tabbatar da firam ɗin ko ɓoye shi.

Don haka ɓoyayya dole ta fito daga hanyar da fakitin GRE ke bi. A wannan zane, ƙasan ƙasa shine bututun WireGuard ko IPsec tsakanin na'urorin sadarwa biyu, kuma EoIP ana ɗaukar sa a cikinsa. MikroTik kuma yana bayar da zaɓin IPsec ta atomatik a kan ma'aunin EoIP kanta, wanda wani tsari ne daban kuma ba shine abin da wannan dakin gwaji ke saita ba.

Don ayyukan IP da aka yi musu hanya, VPN da aka yi musu hanya shine ƙaramin zane kuma wanda ya kamata a fifita. Koma zuwa mataki na biyu ne kawai lokacin da na'ura take buƙatar ganin firam ɗin Ethernet daga wancan shafin.

Abubuwan da ake buƙata: ƙasan ƙasa mai ɓoyayya da tashoshi biyu da ba a yi amfani da su ba

Duk na'urorin sadarwa biyu suna buƙatar ingantaccen hanyar sadarwa mai ɓoyayya da adireshi a kanta wanda takwara zai iya isa. Bangaren LTE ne ke fara haɗin waje, don haka hub ɗin ba ya taɓa yin kira zuwa cibiyar sadarwar wayar hannu, kuma na'urar LTE tana kiyaye yanayin NAT da mai aiki ke buƙata. Tabbatar bututun yana aiki kafin ka ƙara wani abu a kansa, domin ma'aunin EoIP da ba zai iya isa adireshinsa na nesa ba yana kama da wanda aka saita ba daidai ba.

Kowane na'urar sadarwa yana kuma buƙatar tasha ɗaya wadda ba ta riga ta zama memba na gada ba, ba trunk na VLAN ba, ba ma'aunin gudanarwa ba ko hanyar samarwa ba. Dakin gwaji da ke aro tasha mai rai ba dakin gwaji ba ne, kuma yanayin gazawa shine guguwar watsa-baki a cibiyar sadarwa mai aiki. Ka matsar da gudanarwa zuwa wani ma'auni ko zuwa na'urar konsol kafin ka fara.

Hub tunnel address:    10.44.7.1/32
LTE tunnel address:    10.44.7.2/32
Lab ports:             ether7 on both routers, unused
Test hosts:            192.168.77.11/24 and 192.168.77.12/24

Waɗannan ƙididdiga misali ne ba buƙata ba. Dole su kasance a kan ma'aunin bututu kuma a yi musu hanya ta hanyar da aka kare. Manufar wutar bango a kan duka na'urorin sadarwa dole ta yarda GRE tsakanin adireshin bututu biyu, kuma GRE ka'idar IP ce lamba 47, ba tashar TCP ko UDP mai lamba 47 ba. Wannan zane ba ya taɓa fallasa ɗanyen GRE ga kowane daga cikin WAN biyu.

Ƙirƙiri biyun bututu da ID masu daidaitawa

Ƙarshen biyu ma'auni ɗaya ne na hankali da aka bayyana sau biyu, don haka kowane filin ganowa dole ya daidaita. A kan hub:

/interface eoip add name=eoip-lab local-address=10.44.7.1 remote-address=10.44.7.2 tunnel-id=37 mac-address=02:1A:2B:00:00:01

A kan na'urar LTE adireshin suna juyawa kuma MAC ɗin ya bambanta:

/interface eoip add name=eoip-lab local-address=10.44.7.2 remote-address=10.44.7.1 tunnel-id=37 mac-address=02:1A:2B:00:00:02

ID ɗin bututu dole ya daidaita a ƙarshen biyu kuma kada ya yi karo da wani biyu da aka riga aka saita a ɗayan na'urorin sadarwa. Adireshin MAC ƙididdiga ne da ake gudanarwa a gida waɗanda dole su kasance na musamman a cikin yankin mataki na biyu da kake shiga, don haka kada ka sake amfani da ƙima daga misalin mai sayarwa. Sunayen ma'auni na gida ne ga kowace na'urar sadarwa kuma suna buƙatar daidaito kawai don rubutun ka na kanka.

Littafin EoIP na yanzu yana rubuta filayen ƙarshen wuri da ID ɗin bututu kuma yana faɗi sarai cewa EoIP ita ce Ethernet bisa GRE. Babu wani abu a cikin wannan umarni da ke ɓoye wani abu, shi ya sa binciken ƙasan ƙasa ke zuwa farko.

Yi gada da tashoshin gwaji kawai

Gada ita ce ke mai da bututun yanki, kuma membobinta su ne dukan iyakar tsaro. A kan hub:

/interface bridge add name=br-eoiphub protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:01
/interface bridge port add bridge=br-eoiphub interface=ether7
/interface bridge port add bridge=br-eoiphub interface=eoip-lab

A kan na'urar LTE:

/interface bridge add name=br-eoiplte protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:02
/interface bridge port add bridge=br-eoiplte interface=ether7
/interface bridge port add bridge=br-eoiplte interface=eoip-lab

Waɗannan umarnin suna ƙirƙirar sabbin gadoji kuma suna ƙara tashoshi biyu daidai ga kowace. Ma'aunin EoIP shine memba na mataki na biyu; bututun da aka ɓoye ya kasance jigilar da aka yi musu hanya kuma kada a taɓa ƙara shi a matsayin tashar gada. Kada ka ƙara tashar samarwa, kuma kada ka fara sabar DHCP a gadar dakin gwaji.

Ba wa na'urorin gwaji biyu adireshi a cikin wani yanki da ba a yi amfani da shi ba ba tare da sabar DHCP mai gasa ba, kamar 192.168.77.11/24 da 192.168.77.12/24. Ba sa buƙatar ƙofar farko don isa juna a cikin wannan yanki, kuma ba a buƙatar adireshin ma'aunin na'urar sadarwa don firam ɗin su wuce.

Yi lissafin ƙarin nauyin kafin ka faɗaɗa LAN

EoIP bisa IPv4 yana ƙara kan Ethernet, GRE da IP na waje a kewayen kayan da ake ɗauka. Don yanayin da ba a yi wa alama ba, MikroTik yana rubuta 42 byte, don haka ƙasan ƙasa mai 1400 byte na IP MTU mai amfani yana barin 1358 byte ga firam ɗin ciki. Wannan adadi kasafin kuɗi ne ba ƙimar MSS ta duniya ba, kuma ba ya tilasta wa mai karɓar baƙi a cikin gada ya aika ƙananan firamai.

Tabbatar da ainihin iyakoki a kan hanya, sannan ka gwada da mafi girman firam da na'urar ke aikawa da gaske. Firam na 1500 byte wanda dole a raba shi a cikin hanyar da aka kare yana aiki daban da wanda ya shige, kuma bambancin yana bayyana a matsayin tsayawar aikace-aikace ba a matsayin gazawar hanyar sadarwa ba.

/interface eoip print detail where name=eoip-lab
/interface bridge host print where bridge=br-eoiphub
/ping 192.168.77.12 count=4 interface=br-eoiphub

RSTP yana magance madaukai, ba hanyoyin layi ɗaya na son rai ba, don haka ka riƙe tsarin gwajin cikin sauƙi. Faɗaɗa gada yana kuma faɗaɗa halayen watsa-baki, multicast da DHCP a fadin hanyar wayar hannu, kuma wannan zirga-zirgar yana cinye ƙarfin aiki ko wani firam mai amfani yana motsi ko a'a.

Shirya haɗin samarwa ne kawai lokacin da dakin gwaji ya kai girman firam da halayen aikace-aikacen da kake buƙata da gaske. Kafin wannan canji, ka amince kan adireshi, membobin VLAN, ikon DHCP, hana madaukai da yadda wani zai isa na'urorin sadarwa lokacin da hanyar kanta ta ƙare. Faɗaɗa Ethernet yana haɗa yankunan gazawa tare da na'urori, don haka ya cancanci taga canji maimakon wata tasha a kan gada mai aiki.