VPN Pi mai rarraba da yawa: sanya kowane hanya a na'urar da ke yanke shawara
Na'urar rarraba ta ƙasa tana ƙara biyu subnet na abokin ciniki, kuma kowace na'ura huɗu tana da shawara ɗaya. Sanya hanyoyin, duba tushen, sannan gwada daga ainihin abokin ciniki.
Sanya akwatin Wi-Fi a bayan Pi yana mai da shawara ɗaya ta rarraba zuwa huɗu, kuma shirin ya lalace idan aka yanke duka huɗu a na'ura ɗaya. Tambaya ta farko ba wace hanya za a ƙara ba ce. Ita ce ko sabon akwatin yana yin gada ko rarraba, domin wannan amsar tana ƙayyade yawan subnet da suke wanzuwa da na'urorin da za su koyi game da su. Zaɓi tsarin haɗi tukuna; kowace hanya ta bi daga gare shi.
Gada ko rarraba: zaɓin da ke ƙayyade adadi
Gada tana sanya sabbin abokan ciniki a subnet ɗaya da Pi ke yi wa hidima. Subnet ɗaya, hukuma DHCP ɗaya, kuma babu miƙa don rarraba. Wannan shi ne mafi sauƙin tsari kuma daidai lokacin da cibiyar sadarwar abokin ciniki daban ba ta kasance buƙata ba. Hanyar da aka rarraba ita ce wani ƙira dabam: akwatin yana riƙe da nasa subnet, kuma dole ne a ɗauki wannan prefix a duk inda zirga-zirgar ke zuwa.
Sauran shirin yana riƙe da na'urar rarraba ta ƙasa kuma yana kiyaye adiresoshin tushen abokan ciniki. Manufar ita ce hanyar sadarwa ta VPN mai zaman kanta ɗaya, ba cikakkiyar hanyar fita intanet ba. Rubuta tsarin kafin adiresoshin, domin jerin da ke ƙasa misali ne kawai na haɗin da aka rarraba.
client subnet 10.41.0.0/24
client gateway 10.41.0.1
router-to-Pi link 192.168.71.2
Pi on that link 192.168.71.1
private target 10.72.9.0/24Wanene ke yanke shawara me
| Decision owner | Entry that encodes the decision | Failure when the entry is missing |
|---|---|---|
| Pi VPN host | Return route for 10.41.0.0/24 via 192.168.71.2, and a tunnel route for 10.72.9.0/24 | Replies to downstream clients die at the Pi |
| Owner of the remote network | A path for 10.41.0.0/24 over the permitted tunnel | Replies stop at the first unaware hop |
| LAN router behind the Pi | Specific route for 10.72.9.0/24 via 192.168.71.1, or a suitable default | Clients never send private traffic to the Pi |
| Client machine | Default via 10.41.0.1, or a specific entry for 10.72.9.0/24 | The private network is unreachable from the client |
Kowace na'ura tana yanke shawara ɗaya, kuma babu wadda za ta iya yanke ta wani a madadinsa. Pi yana buƙatar shigarwa biyu, ba ɗaya ba, kuma hanyar dawowa ita ce da mutane suke mantawa. Zirga-zirgar da aka tura gaba tana isa hanyar sadarwa mai zaman kanta daidai sannan ta mutu a hanyar dawowa, domin Pi bai san inda 10.41.0.0/24 yake zama ba. Wannan yana kama da matsalar wutar bango kuma a gaskiya hanya ce da ta ɓace.
Bangaren nesa ma yana buƙatar nasa hanya. Idan sabis ɗin da ke ƙarshen nesa bai san cewa ana iya isa 10.41.0.0/24 ta hanyar tunnel ɗinka ba, amsoshi suna tsayawa a tsalle na farko da ba shi da amsa. Ƙara duka kwatance kafin karanta matatun fakiti.
Tsalle na gaba suna zuwa daga haɗin
Tsalle na gaba dole ne ya zama adireshi a hanyar sadarwar da na'urar za ta iya isa da gaske. Adireshin jama'a na abokin VPN ba shi ne tsalle na gaba don subnet mai zaman kanta ba, kuma hanyar sadarwar sabis ta nesa ba tsalle na gaba ba kwata-kwata. Hanya zuwa ƙofar da ba za a iya isa ba tana kama daidai a cikin jeri kuma tana jefar da kowane fakiti. Tabbatar ƙofar tana amsawa kafin ka zargi makoma.
Riƙe abokin VPN na waje na Pi ana iya isa ta hanyar nasa hanyar ƙasa. Wannan shigarwar ta bambanta da hanyoyin kaya, kuma haɗa su yana ba da tunnel da ba zai iya sake kafawa bayan canjin hanya.
Takardun hanyoyin da ba su canzawa suna bayyana bambanci tsakanin makoma da ƙofa, ko da kowace dandamali tana kiran menus ɗinta daban. Karanta takardun na'urar da ke gabanka maimakon kwafin allon wani mai sayarwa. Umarnin da ke ƙasa suna nuna siffar shigarwar a Linux.
# on the Pi
ip route add 10.41.0.0/24 via 192.168.71.2
ip route add 10.72.9.0/24 dev tun0
# on the downstream router
ip route add 10.72.9.0/24 via 192.168.71.1Me fassarar ke yi wa tushen
Idan na'urar rarraba ta ƙasa tana riga tana fassara abokan cinikinta zuwa adireshin wucewa, Pi yana ganin tushe ɗaya da aka fassara maimakon adireshin kowane abokin ciniki. Wannan wani ƙira ne dabam da wanda ke kiyaye tushe a sama. Yana canza manufofin da suka dogara da tushe, rikodin, da wace gefe za ta iya fara haɗi. Dukansu ƙirar suna aiki; suna amsa tambayoyi dabam.
Lokacin da sabis ɗin VPN na sama ya ƙi rarraba prefix ɗin abokin ciniki baya, fassarar ƙunci a fitowar tunnel ɗin Pi na iya zama hanyar wucin gadi mai halatta. Wannan ba hujja ba ce cewa hanyar da ta ɓace ba ta da amfani. Yi rikodin wane adireshi hanyar sadarwar nesa take gani da gaske da wace hanyar dawowa ta biyo.
Zaɓin hanya, izinin turawa gaba da fassarar tushe sun kasance ayyuka uku dabam. Wanke sarkar NAT da aka raba ko ba da izini ga kowace mu'amala saboda abokin ciniki ɗaya mai waya yana aiki ita ce hanyar da gwaji mai aiki ke zama buɗaɗɗen mai turawa.
Tabbatar da shi daga na'urar abokin ciniki
Aika buƙata daga na'ura da ke LAN ta ƙasa, sannan bi tushenta waje da dawowa. Ping da Pi ya aika ba ya taɓa amfani da hanyar dawowa ta ƙasa, shi ya sa ping mai nasara ke tabbatar da ƙasa da yadda yake kama. Ƙara gwaji na biyu daga abokin ciniki mai waya a LAN ɗin Pi don a kwatanta hanyoyin biyu. Maimaita dukansu bayan sake kunna kowace na'ura.
Hanyoyin da aka ƙara da hannu da fassarorin da ba a taɓa adanawa ba suna ɓacewa tare. Sannan ma'auratan suna kama da sabuwar matsala maimakon aikin da bai ƙare ba.
Adana tsarin haɗi tare da hanyoyin, sabis ɗin mai zaman kansa da aka yarda da shi da kowace fassara a cikin rubutu ɗaya. Wannan rubutun shi ne ke hana na gaba ɗaukar sanya mara waya a matsayin tambaya ta manufar rarraba.