Me ya sa VM ɗin ku na GCP ba zai iya amsa wa pool ɗin IPv6 na OpenVPN ba

Abokin ciniki na IPv6 VPN ɗinku ya isa wurin aiki, wurin aikin ya amsa cikin rami, amma amsar ba ta taɓa zuwa ba. Tunani na farko shi ne zargin firewall ko ramin, kuma yawanci babu wanda ke da laifi. Adireshin da OpenVPN ke bayarwa cibiyar sadarwa ce ta ciki wadda ba ta wanzu sai cikin ramin; Google Cloud ba ta da masaniyar cewa fd42:90::/64 ya kamata ya kasance a bayan wata VM ta musamman har sai kun gaya mata.

Dole ne tsarin biyu daban-daban su koyi wannan gaskiyar, kuma ɗaya ne kawai daga cikinsu OpenVPN. VPC na buƙatar hanya kafin ta iya mayar da wani abu, kuma dole a ba VM izinin tura abin da ya zo. Idan kun yi kuskure a kowane rabi, alamar za ta yi kama ɗaya.

Pool ɗin cibiyar sadarwa ce ta ciki, ba subnet ba

OpenVPN na iya bayar da adiresoshin IPv6 daga kewayon da kuka zaɓa, kuma wannan kewayon ƙage ne da ƙarshen rami biyu suka yarda da shi. Ba subnet ɗin Google Cloud ba ne, ba ya bayyana a jerin subnet ɗin VPC, kuma ƙofar sadarwar VM ba ta samun waɗannan adiresoshin. Don haka aikin da ke amsa wa abokin ciniki yana aika fakiti zuwa adireshin da cibiyar sadarwa ke ɗauka ba za a iya yi masa hanya ba.

Ku ajiye pool ɗin a wajen kowane kewayon da VPC ke amfani da shi. Ku ajiye shi a wajen kewayon da ke bayan sauran ramukan ku kuma. Haɗuwa na mayar da rashin nasarar hanya mai tsabta zuwa ta lokaci-lokaci wadda ba ta bayyana sai ƙarƙashin nauyi.

Adireshin gida na musamman kamar fd42:90::/64 zaɓi ne mai ma’ana ga wannan cibiyar sadarwa ta ciki. Prefix ɗin kuma yana tunatar da cewa ƙirar sirri ce daga asali. Babu wani abu a cikin pool ɗin ULA da zai mai da shi tushe na halal a intanet na jama’a.

Ba VPC manufa da mataki na gaba

Amsar na buƙatar hanyar VPC wadda manufarta ita ce pool ɗin kuma matakinta na gaba ita ce VM ɗin VPN. Takardun hanyoyin tsaye na yanzu sun ƙunshi kewayon manufa na IPv6 kuma sun lissafa waɗanne nau’ikan mataki na gaba ne suka cancanta, don haka ku tabbatar da sigar da ake goyan bayan ga topologiyar ku maimakon kwafin tsohon misalin IPv4.

Adireshin mataki na gaba dole ya zama wanda aka keɓe wa ƙofar sadarwar girgije ta instance ɗin da gaske. Adireshin ciki na ramin VM ba shine wannan adireshin ba. Amfani da shi duk da haka yana haifar da hanya wadda ke shigarwa cikin tsabta kuma ba ta taɓa dacewa da wani fakiti ba. Ku karanta jerin ƙofofin kafin ku rubuta hanyar.

Girman hanyar yana da muhimmanci kamar shigarwar kanta. Hanyoyin subnet sun fi ƙayyadaddun hanyoyin da kuka ƙara, don haka pool da aka yanke daga kewayon subnet da ke akwai zai sha kashi a gaban hanyar subnet, ko yaya aka rubuta hanyar da aka ƙera. Ku zaɓi pool daban, sannan ku tabbatar hanyar tana nuna instance ɗin a matsayin mataki na gaba da madaidaicin prefix ɗin manufa:

gcloud compute routes create vpn6-return \
  --network=vpn-vpc \
  --destination-range=fd42:90::/64 \
  --next-hop-instance=openvpn-vm \
  --next-hop-instance-zone=europe-west1-b

Dole a kunna turawa sau biyu

Hanya tana isar da fakiti ga instance ɗin. Ba ta sa instance ɗin ya yarda ya tura wani abu da ba a yi masa adireshi ba, kuma wannan izinin yana wanzuwa a matakai biyu.

Bangaren girgije na buƙatar ikon turawa na instance ɗin a kunne; wannan shine saitin da ke barin VM karɓar zirga-zirga ga adiresoshin da ba ya mallaka kuma ya wuce da su. Bangaren baƙo na buƙatar turawar IPv6 nasa, domin kernel yana yanke shawara daban bayan fakiti ya iso. Dole duka biyu su kasance a kunne kafin amsa ɗaya ta ratsa ramin.

sysctl -w net.ipv6.conf.all.forwarding=1

Bayan haka dokokin firewall dole su ƙyale kewayon tushen ciki a dukkan kwatance biyu. Google Cloud na kimanta faktin da aka cire kwali, don haka dokar da ke rufe subnet ɗin VPC kawai tana zubar da zirga-zirgar pool ɗin bayan ramin ya riga ya yi nasara. Ƙara pool ɗin a matsayin kewayon tushe a dokar shiga, kuma ku duba cewa babu wata manufar fita da aka ƙera da ke toshe amsar. Dokar izini ta bayyana tana rufe yanayin da aka saba, dokar fita da aka rubuta da hannu ba ta rufe ba.

Faɗa wa OpenVPN wanene ya mallaki me

OpenVPN yana turawa ga abokin ciniki idan ya san wannan abokin cinikin ya mallaki manufar. Adiresoshin abokan ciniki daga pool ɗin umarnin uwar garke da ke ayyana pool ɗin ke kula da su, amma subnet da ke bayan abokin ciniki wani tsari ne daban kuma yana buƙatar shigarwar mallaka bayyananna ga wannan abokin cinikin.

Haɗa su biyu yana haifar da rami inda ping zuwa uwar garke ke aiki kuma babu abin da ke bayansa. Ku yanke shawara wace hali kuke ginawa, sannan ku rubuta shigarwar da ta dace maimakon ƙara layin push na biyu da yin fata.

Ku ajiye fitarwar intanet a wajen wannan ƙira

Samun sirri da samun intanet shirye-shirye ne daban. Pool ɗin ULA na iya isa ayyukan VPC ta ramin da zarar an daidaita hanya da turawa, kuma wannan pool ɗin ba shi da hanya zuwa intanet na jama’a ta VPC, domin ƙofar girgije ba za ta karɓi tushen rami na son rai a matsayin nata ba.

Idan abokan ciniki kuma suna buƙatar fitarwar intanet, ku tsara ingantaccen tsarin adireshi da hanya dominsa, ku ajiye shi dabam da pool ɗin sirri, kuma ku gwada hanyoyin biyu daban. Hanya ɗaya da ke aiki ba ta faɗi komai game da ɗayan ba, kuma ƙirar da ta haɗa su tana gazawa ta yadda za a yi kama da karyayyen rami.