Sanya miƙa IPv4 ya dawwama bayan sake kunna ƙofar hanyar VPN

Yin ping ɗin ƙofa yana aiki amma isa ga kowane abu a bayanta ba ya aiki, kuma wannan siffar matsalar miƙa ce ba matsalar rami ba. Isar da gida zuwa ƙofar yana tabbatar da cewa ramin ya tashi kuma rabon adireshi ya yi aiki; amma ba ya faɗin komai game da ko kernel zai wuce fakiti daga wata mu’amala zuwa wata. Kafin ka taɓa kowane sysctl, tabbatar cewa an yi nufin na’urar don yin hanyar wannan zirga-zirga kuma nemo mahallin cibiyar sadarwa wanda ke riƙe mu’amalar da ke fuskantar abokin ciniki. Sa’an nan ka karanta darajar a can, ba inda jagorar ƙarshe da ka karanta ta yi kallo ba kwatsam.

Isar zuwa ƙofa ba ɗaya ba ce da miƙa

Ana yanke shawara biyu daban-daban a cikin kernel. Isar da adireshin gida yana ƙarasa tafiyar fakiti; miƙa yana sake tura shi waje ta wata mu’amala, kuma ana sarrafa wannan shawara ta biyu bisa kowane sararin suna na cibiyar sadarwa. Ƙofa na iya zama mai isa sosai yayin da miƙa a kashe, kuma daga alamar ping waɗannan gazawa biyu suna kama da juna.

Rubuta a wace mu’amala fakiti na abokin ciniki ke shigowa da kuma ta wace mu’amala hanyar gaba ke fita. Dukansu suna cikin sararin suna ɗaya, kuma wannan sararin sunan ne ke riƙe ma’aunin da ke da muhimmanci.

Karanta darajar a inda fakitin suke a zahiri

A kan ƙofar da ke yin hanya a cikin sararin sunan mai masauki, umarni ɗaya yana amsa tambayar: sysctl net.ipv4.ip_forward. Lokacin da hanyar shigowa da ta gaba suke rayuwa a cikin sararin suna mai suna, tambayi wannan sararin sunan: ip netns exec vpn-gw sysctl net.ipv4.ip_forward. Darajar mai masauki ba ta maye gurbin darajar sararin suna ba, kuma ɗaya a kan mai masauki ba hujja ba ce ga komai.

Ba kowane mahallin hanyar sadarwa ne ke da lakabi da za ka iya ba da shi ga ip netns. Muhallin tafiyar da kwantena da ayyuka suna ƙirƙirar sararin suna waɗanda ba a taɓa yin rajista a ƙarƙashin suna mai sauƙi ba, kuma don waɗannan kana amfani da kayan aikin binciken muhalli. Maye gurbin vpn-gw da ainihin suna, ko da hanyar muhalli da ke isa ga wannan mahalli, kuma ka daina hasashe a matakin mai masauki.

Ba da ma’aunin mai shi ɗaya

A kan ƙofar mai masauki ta systemd ta al’ada, sigar dawwama ita ce fayil ɗin drop-in mai sunan da mai gudanarwa ya zaɓa, kamar /etc/sysctl.d/60-vpn-forwarding.conf, wanda ke ɗauke da net.ipv4.ip_forward = 1. Rubuta fayil ɗin, sannan loda wannan takamaimai fayil ɗin domin yanayin raye-raye ma ya canza: sudo sysctl -p /etc/sysctl.d/60-vpn-forwarding.conf, sannan karantawa baya. Sunan fayil ɗin misali ne ba hanyar VPN da aka tanada ba, kuma lambar farko tana da muhimmanci domin fayilolin da aka jera daga baya suna cin nasara.

Babban fifiko shine inda dawwama ke karyewa a hankali. Duba mai lodin rarrabawa da kuma naka drop-in, domin procps sysctl --system ma yana karanta /etc/sysctl.conf a ƙarshe, yayin da tsarin sysctl.d na systemd wani tsari ne daban. Sanyawa daga baya na iya mayar da maɓalli ɗaya kai tsaye, yana barin fayil ɗinka daidai kuma ingantacciyar darajar ba daidai ba. Kada ka sake rubuta fayil ɗin mai gudanarwa da ke akwai don cin wannan muhawara; nemo mai shi ka canza a can.

Sararin suna da aka ƙirƙira bayan tashi ba a sarrafa shi da drop-in na mai masauki kwata-kwata. Ma’auninsa na wanda ya ƙirƙira shi ne, ko muhallin tafiyar da kwantena ne ko sashin samar da sararin sunan. Ba wa kwantena babban haƙƙin mai masauki don guje wa tambayar ciniki ne mafi muni fiye da kashe minti goma wajen gano ainihin mai shi.

San abin da maɓallin ke kashe kafin ka juya shi

ip_forward ba boolean marar lahani ba ne. Takardun kernel sun lura cewa canza shi yana sake saita wasu sigogi na IPv4 da yawa zuwa tsoffin mai masauki ko na na’urar hanya, don haka juyawa na bincike na iya watsar da gyare-gyaren da aka yi wani wuri ba tare da ambatarsa ba. Dauke shi a matsayin canjin tsari mai illolin gefe ba gwajin da za a iya yi cikin sakaci ba.

Wannan ma yana hana kashewa da kunnawa a duk lokacin da abokin ciniki ya kasa isa ga mai masauki. Idan darajar ta riga ta zama ɗaya, laifin yana wani wuri a hanya, kuma sake rubuta maɓalli ɗaya a karo na uku ba zai motsa shi ba.

Tabbatar da dawwama, sannan gwada sauran hanyar

Karanta darajar a karo na huɗu: nan da nan bayan canjin, bayan mu’amalar VPN ta bayyana, bayan sake haɗawa, da bayan sake kunnawa da aka tsara. Darajar da ke komawa a kowane ɗaya daga waɗannan wuraren tana da mai shi na biyu, kuma ƙarin rubutu ɗaya kawai yana ɓoye shi har zuwa sake kunnawa na gaba.

Miƙa da aka kunna har yanzu yana barin abubuwa uku don tabbatarwa. Abokin ciniki yana buƙatar hanya zuwa wurin da aka nufa, ƙofar tana buƙatar hanyar gaba da izinin amfani da ita, kuma wurin da aka nufa yana buƙatar hanyar dawowa zuwa adireshin ramin abokin ciniki. LAN mai zaman kansa da aka yi hanya ba ya buƙatar NAT kai tsaye, don haka kada ka ƙara masquerading kafin ka san wanne daga cikin ukun ya ɓace, kuma gwada daga abokin ciniki da aka nufa ba daga ƙofar kanta ba, domin buƙatar da ta samo asali a kan ƙofar ba ta taɓa hanyar miƙa da ka kunna yanzu ba. IPv6 yana ɗauke da nasa manufar miƙa da hanyar sadarwa, don haka gwajin IPv4 mai aiki ba ya faɗin komai game da shi.

Riƙe hanyar drop-in, mai shi na sararin suna da umarnin karantawa baya tare a cikin runbook. Wanda ya karɓa wannan na gaba ya kamata ya iya karanta darajar, ganin wanda ya mallake ta, kuma ya yanke shawara cikin minti ɗaya ko matsala dawwama ce ko sauran hanyar.