IPv6 tana mutuwa bayan an sake kunna OpenVPN: duba wanda ya mallaki prefix ɗin
IPv6 tana mutuwa bayan an sake ƙirƙirar tunnel ɗin. Yanke shawara wanda ya mallaki prefix ɗin da aka wakilta, adiresoshin abokan ciniki da hanyar dawowa kafin ka sake kunna wani abu.
IPv6 tana daina wucewa da zirga-zirga a lokacin da OpenVPN ya sake kunna, kuma IPv4 na ci gaba da aiki. An sake ƙirƙirar interface ɗin tunnel ɗin, kuma wani abu dabam da ke kula da yanayin IPv6 ɗinsa ya rasa adireshin ko ya rasa hanyar da ke sa prefix ɗin ya isa. Akwai sassa uku daban-daban na yanayi da abin ya shafa, kuma kowanne yana da mai shi daban: prefix ɗin da aka wakilta daga mai bayarwa da tsawon rayuwarsa, adiresoshin da aka ba abokan ciniki na VPN, da hanyar sama da ke mayar da wannan prefix na abokin ciniki zuwa uwar garke. Gano mai kowane ɓangare kafin ka taɓa kowane daemon, domin sake kunna wanda bai dace ba yana ɓoye matsalar har kwana ɗaya sannan ta dawo a haɗin gaba.
Sassa uku na yanayin IPv6, masu shi uku
| State | Typical owner | What breaks when it is wrong |
|---|---|---|
| Delegated prefix and lifetime | Upstream router or provider via DHCPv6-PD | Clients keep addresses that the upstream no longer routes |
| Client addresses inside the tunnel | OpenVPN server config or a delegation daemon | No global address, or an address outside the routed prefix |
| Return route for the client prefix | Upstream router, or the server's own routing table | Outbound works, replies never arrive |
Adireshi mai faɗin duniya a cikin tunnel ɗin bai isa shi kaɗai ba. Har yanzu wajibi ne rahotannin sama su mayar da wannan prefix ɗin zuwa uwar garken VPN, kuma ba za su yi haka ba don kawai uwar garken tana da adireshi daga gare shi.
Shi ya sa kuma kwafin /64 na jama'a cikin tafkin tunnel yana da haɗari. Prefix ɗin da aka tura zuwa uwar garke ba ɗaya yake da prefix ɗin da gefen sama ke ɗaukarsa a matsayin on-link ba, kuma gano maƙwabta ba zai cika wannan gibin ba.
Karanta yanayin uwar garke kafin ka canza wani abu
Ɗauki yanayin sau biyu, sau ɗaya yayin da IPv6 ke aiki kuma sau ɗaya bayan sake kunna, sannan ka kwatanta. Ra'ayoyin karatu kawai sun isa, kuma ba su da wani kuɗi a lokacin taga gyara:
ip -6 addr show
ip -6 route show table all
ip -6 rule show
sysctl net.ipv6.conf.all.forwardingNemi bambance-bambance uku na musamman: hanyar da ta ɓace, adireshin da ya koma tsawon rayuwa da ya tsufa ko mara inganci, da prefix ɗin da ya canza bayan sake wakilta yayin da tsarin VPN ɗin har yanzu yana shelar tsohon.
Idan adireshin ya ɓace amma prefix ɗin bai canza ba, daemon ɗin da ke ba da shi ya daina kula da interface ɗin. Idan prefix ɗin ya canza amma adiresoshin ba su canza ba, tsarin abokin ciniki ya tsufa. Gazawar biyu suna kama da juna daga mai bincike kuma ba su da wani abu ɗaya.
Yanke shawara ko dhcpcd zai kula da tunnel ɗin
dhcpcd na iya gano interfaces da wakilta sassan prefix na DHCPv6 zuwa interfaces na ƙasa, kuma tsarinsa na iya ambaton maƙasudin wakilta a fili. Ba tare da maƙasudi bayyananne ba, halinsa da aka rubuta na iya haɗa da wasu interfaces, kuma haka tunnel ɗin yakan sami adireshin da babu wanda ya tsara.
Sharudda biyu ya kamata su tura ka ga barin OpenVPN ya mallaki adireshin tsaye na tunnel ɗin: uwar garken tana tura adiresoshin daidaitattu a cikin tsarinta, kuma sunan tunnel ɗin yana canzawa a sake haɗi. Idan duka biyun sun tabbata, cire tunnel ɗin daga daemon ɗin wakilta da gangan, tare da sharhi da ke faɗin dalili.
Idan a maimakon haka wakilta zuwa tunnel ɗin da gangan ne, aiwatar da kulawar canjin prefix. Wannan yana nufin amsa lokacin da prefix ɗin da aka wakilta ko tsawon rayuwarsa ya canza, sabunta prefix ɗin abokin ciniki da uwar garken ke shela, da sake ƙara hanyar. Cire interface ɗin a wannan tsarin zai kawar da ɓangaren da ya san sabon prefix ɗin.
Sake kunna dhcpcd na iya zama kamar yana gyara abubuwa domin yana sake ƙirƙirar yanayi, amma kuma yana sabunta ko cire tsarin interfaces da ba ka yi tunanin su ba. Wannan dawo da yanayi baya sa ya zama wajibi bayan kowane sake kunna VPN. Yana kuma sake saita ƙididdigar da kake amfani da su a matsayin hujja. Ka fifita sake lodin interface ɗin da ka canza da gaske.
Tabbatar da IPv6 daban da NAT na IPv4
Tabbatar cewa turawa tana kunne kuma hanyar sama tana nuni ga ainihin prefix ɗin abokin ciniki, sannan ka yi sabon haɗin IPv6 da aka yarda da shi. Duba kuma teburin hanya na IPv6 na abokin ciniki da kansa, domin abokin ciniki da ke nuna adireshin jama'a baya tabbatar da cewa bukatarsa ta yi amfani da tunnel ɗin.
Maskin IPv4 yana warware wata matsalar dabam: hanyar dawowa ga tushen sirri. Bai yi komai ga prefix ɗin IPv6 da aka janye ba, kuma ƙarasa shi ba zai dawo da IPv6 ba.
Kammala da rikodin mallaka: wane ɓangare ne ke wakilta prefix ɗin, wanne ne ke ba da adiresoshin abokan ciniki, wanne ne ke riƙe hanyar dawowa, da abin da ke faruwa da kowanne a sake haɗi. Layi huɗu a cikin runbook suna ceto mutum na gaba daga sake kunna daemons uku don nemo wanda ya fi muhimmanci.