IPv6 link-local ba ya aiki a kan VPN: me ya sa fe80 ke tsayawa a mahadar
Adireshin fe80:: yana da ma'ana ne kawai a mahada ɗaya. Ga dalilin da VPN mai tuƙi ba zai iya ɗaukar shi ba, yadda gazawar ke nunawa, da adireshin da za a yi amfani da shi a maimakon haka.
Ka ka da tunnel ɗin, ka yi ping fe80::1 tare da tunnel a matsayin interfac ɗin tushe, sai babu komai da ya dawo. Ba ƙa'idar firewall da ka manta ba ce. Adireshin link-local yana da ma'ana ne kawai a kan mahada ɗaya da aka samar da shi, kuma VPN mai tuƙi ba ita ce wannan mahadar ba. fe80::1 na na'urar router ta nesa yana kan sashin LAN na nesa; kai tsayawa kake a nesa da mataki ɗaya a wani sashe daban, kuma IPv6 ba ta da wata hanya da router zai iya tura fakitin link-local kwata-kwata.
Faɗin fe80 yana bayyana iyaka, ba jeri ba
Link-local unicast shine fe80::/10, kuma sifar da ke bayyana shi ba ita ce lambar ba, iyakancewar ce. Adireshin yana aiki ne kawai a mahada ɗaya, kuma kowace interface tana ƙirƙirar ɗaya daga nata mai gano, wanda shine dalilin da ya sa injuna biyu da ba su da alaƙa a cibiyoyin sadarwa biyu da ba su da alaƙa duka suna iya amsa fe80::1 ba tare da wata matsala ba. Prefix ɗin a zahiri yana cewa “a kan wata mahada”; mahadar kanta tana zuwa daga mahallin.
A kan na'ura, wannan mahallin shine zone, ko scope ID, da kake ƙarawa bayan alamar kashi ɗari: fe80::1%eth0 a Linux, fe80::1%3 ko fe80::1%12 a Windows da kuma cikin kayan aikin da ke nuna index ɗin interface. Kernel ɗin yana warware adireshin tare da index ɗin interface sannan ya aika. Idan ka cire zone ɗin, inda ake zuwa ba shi da tabbas, don haka stack ɗin ba shi da hanyar zaɓar sashe.
Me ya sa tunnel mai tuƙi ba zai iya isar da shi
VPN mai tuƙi interface ne na mataki-bi-mataki da ke ɗauke da nata adiresoshin, yawanci /64 na sararin IPv6 na musamman-na-gida ko na sirri a cikin tunnel ɗin. LAN na nesa wata mahada ce daban, wadda ake isa gareta ta hanyar ƙarshen tunnel ɗin yana tuƙi da turawa a madadinka. Waɗannan sassa ne biyu daban-daban, don haka adireshi daga ɗayan ba ingantaccen inda ake zuwa ba ne a ɗayan.
Ƙa'idar turawa a bayyane take a cikin ma'auni maimakon wani hali na client ɗinka: router ba sa tura fakitin da ke da tushe ko inda ake zuwa na link-local. Wannan shine dalilin da ya sa fakitin ke mutuwa ko da teburin route ɗin ya yi kama da daidai. Idan ka ƙara route na fe80::/64 da ke nuni ga tunnel ɗin, stack mai bin ka'ida ko dai ya ƙi shi ko ya karɓe shi sannan ya watsar da kowane fakitin da ya dace: iyakancewar inda ake zuwa tana cewa “wannan mahada ce kawai”, kuma interface ɗin da ake fitarwa ba ita ce wannan mahadar ba.
Binciken maƙwabta yana ƙarfafa wannan iyaka ɗaya. Na'urori suna warware matakan gaba na link-local da buƙatar maƙwabta da ake turawa zuwa multicast na iyakar mahada tare da iyakar tsalle na 255, don haka router na iya ƙin duk abin da aka tura. Yin hakan a fadin tunnel zai nufin yin wakiltar bincike ga wani sashe na nesa, wanda shine haɗin Layer 2 sanye da wata hula.
Akwai gazawa ta biyu da ta fi shiru, kuma tana kama mutanen da suke ƙoƙarin tilasta route ɗin ko ta yaya: zone ɗin. Duk zone da ka rubuta a gida yana ambaton interface ɗin tunnel, yayin da adireshin da kake so yana manne da interface ɗin LAN na nesa. Su biyun ba sa taɓa daidaitawa, don haka ba za a iya tura fakitin zuwa interface ɗin da ya dace a ƙarshen nesa ba.
Yadda gazawar ke nunawa a aikace
Fitowar kayan aiki don kuskuren iyaka tana karantawa kamar kuskuren route ko firewall, wanda shine ainihin dalilin da ya sa mutane ke kashe wata rana a cikin layin da bai dace ba.
| What you run | What you see | What it means |
|---|---|---|
| ping fe80::1 with no zone | Invalid argument on Linux, or a transmit failure on Windows | The stack cannot pick an interface for an ambiguous destination |
| ping -6 -I tun0 fe80::1 | Destination unreachable, or a silent timeout | The address is not on the tunnel link, so there is nothing on-link to answer |
| ssh user@fe80::1 after the tunnel is up | Hangs, then no route to host | The SYN never left the machine in a deliverable form; the server logs nothing |
| ip -6 neigh show dev tun0 | Empty table | No neighbor entry can exist for a link-local host that is not on this link |
| fe80::/64 inside AllowedIPs or route-ipv6 | Config accepted, traffic still dropped | The tunnel carried the packet; the receiving stack refused to forward it |
Layi na uku shine ya fi ɓata lokaci, saboda client ɗin ssh wanda ba ya fitar da komai yana kama da matsalar sabis ɗin da ke saurare. Idan kana da wata hanya ta shiga, duba ɓangaren nesa ka tabbatar ko sshd yana ɗaure da dukkan adiresoshi ko ɗaya kawai.
Yi amfani da adireshin da aka yi nufin turawa
Ga duk abin da kake buƙatar isa ta tunnel ɗin, yi amfani da adireshin da aka ba sabis ɗin don wannan manufar: adireshin global unicast, ko adireshin unique-local daga fc00::/7, kewayon da aka tanada don wannan yanayin na ciki. Tabbatar cewa mai saurare yana ɗaure shi da gaske, sannan ka tabbatar da hanyar dawowa da duk wata ƙa'idar firewall ta na'ura.
Duba na'urar da ke nesa maimakon yin hasashe. ip -6 addr show yana lissafa adiresoshin da suke, kuma ss -6 -ltn yana lissafa abin da daemon ɗin ke saurare. Sabis ɗin da aka ɗaure kawai da fe80:: ana iya isa gare shi ne kawai daga nata sashin, wanda yawanci tsoho ne wanda babu wanda ya zaɓa da gangan kuma ana iya canza shi da yardar mai gudanarwa.
Lokacin da sabis ɗin da gaske ba zai iya sake ɗaurewa ba, ka motsa gadar zuwa layin aikace-aikace maimakon layin cibiyar sadarwa. Relay a kan na'urar nesa da ke saurare a wani adireshi mai iya turawa kuma yake haɗawa da na link-local yana warware matsalar ba tare da faɗaɗa wani sashe ba:
socat TCP6-LISTEN:8080,bind=[fd00:1:2::10] TCP6:[fe80::1%eth0]:80A nan zone ɗin yana a gefen da ya dace, a kan na'urar da ke da eth0 a wannan mahadar da gaske. Client ɗinka yana magana da fd00:1:2::10, wanda ke tafiya akai-akai, kuma relay ɗin yana yin tsallen link-local a cikin gida. Wannan dabarar tana aiki ga web UI na na'urar ko tsohuwar BMC da ke tallata adireshin link-local kawai.
Lokacin da gada ce da gaske amsar, da abin da za a duba
Wasu turawa suna buƙatar sashe ɗaya da aka raba: na'urar da ke magana da binciken link-local kawai, na'urar da ta dogara da multicast, dakin gwaji da ke sake haifar da LAN mai lebur. Wannan matsala ce ta Layer 2 kuma tana buƙatar amsar Layer 2, kamar na'urar tap da aka haɗa da interface ɗin nesa ko samfurin client mai yanayin gada bayyananne. Yana kashe maka turawar watsa shiɗa da multicast da ke tsallaka tunnel ɗin tare da binciken maƙwabta wanda dole ya yi aiki daga ƙarshe zuwa ƙarshe.
Kada ka gwada kusantar da shi ta ƙara fe80::/64 cikin profile mai tuƙi. Hakan yana haifar da mafi munin yanayi: tsarin ya yi kama da kammala, teburin route ɗin yana nuna shigarwa, kuma kowane fakitin har yanzu ana watsar da shi a wani wuri tsakanin stacks biyu da duka suna aiki daidai.
Tabbatar da interface ɗin maimakon ping ɗin. ip -6 addr show tun0 yana gaya maka ko mahadar tunnel ɗin ta samar da nata adireshin link-local, kuma ip -6 route get fe80::1%tun0 yana gaya maka abin da kernel ɗin zai yi da gaske ga inda ake zuwa mai iyaka. Lokacin da kernel ɗin ya ce ba za a iya isa inda ake zuwa ba a wannan interface ɗin, babu wani saitin tunnel da zai canza hakan, kuma lokaci ya yi da za ka daina gyara profile ɗin.
Jerin gajere da ke warware tambayar:
- Karanta adireshin a kan na'urar nesa ka lura ko fe80:: ne ko prefix mai iya turawa.
- Idan fe80:: ne, sake ɗaure sabis ɗin, yi relay a wannan na'urar, ko ka gada sashe ɗin; idan mai iya turawa ne, gyara route, firewall, ko adireshin ɗaurewa.
- Sake duba zone ɗin duk lokacin da ka sake gwadawa, saboda umarnin da aka kwafa yawanci yana riƙe da interface ɗin da ba daidai ba.
Majiyoyi: RFC 4291, tsarin adireshin IPv6.