Abokan ciniki na OpenVPN ba sa ganin juna: subnet ko net30?

Abokan ciniki suna isa uwar garke amma ba juna ba. Raba kuskuren da ping daya, sannan zabi yanayin subnet, client-to-client ko sashin TAP da aka gada.

Kuskure biyu da ba su da alaka suna haifar da korafi daya. A na farko, wani abokin ciniki ba ya isa wani ko da ta adireshin tunnel, domin adiresoshin ba a cikin subnet daya suke ba ko uwar garke ba ya tura zirga-zirgar tsakanin 'yan uwansa. A na biyu, ping yana aiki kuma jerin na'urori na manhajar ya kasance babu komai, domin ganowa ya dogara da watsa shirye-shirye wanda tunnel na mataki na 3 ba zai iya dauka ba. Ping daya yana raba su, kuma gyaran kowanne bai yi kama da gyaran dayan ba.

Ping daya ya raba matsalar gida biyu

Daga abokin ciniki daya, yi ping ga adireshin tunnel na dayan, ba sunansa ba kuma ba adireshin LAN nasa ba. Idan hakan ya kasa, turawa ko adireshi ne matsalar kuma ganowa ba ta da amfani har sai an gyara. Idan ya yi nasara, turawa tana aiki tuni kuma abin da ya rage shi ne watsawa ko warware sunaye.

ip addr show tun0

Karanta ma'aunin abokin ciniki kafin wani abu, domin netmask yana ambatar yanayin. /24 ko wata mask ta subnet tana nufin wurin ajiya na tarayya; /30 da adireshin abokin tarayya tana nufin tsohon tsari na aya-zuwa-aya, inda kowane abokin ciniki yake da makwabci daya kacal, uwar garke.

net30 da subnet, ana karantawa daga bangaren abokin ciniki

What you observenet30subnet
Client netmask/30 with a peer addressThe pool's own mask
Peers a client can address directlyOne, the serverEvery client in the pool
AddressingOne /30 block per client, with the server as the only peerOne pool mask shared by all clients
Effect of client-to-clientRequired for any peer trafficRequired for peer traffic, still no broadcast

Da net30 uwar garke tana ba da karamin yanki ga kowane abokin ciniki, don haka babu hanya zuwa adireshin tunnel na wani abokin ciniki sai uwar garke ta tura shi. Da subnet duk wurin ajiyar cibiya daya ne, kowane abokin ciniki zai iya magana da kowane, kuma uwar garke tana turawa tsakaninsu. Shi ya sa tsarin uwar garke daya zai iya yin kyau alhali ping tsakanin 'yan uwa yana kasa: babu abin da ya karye, abokan ciniki ba su cikin cibiya daya kawai. Abokin ciniki yana ganin hanyar da ke aiki da adireshin abokin tarayya da ba ya amsa, wanda yake karantawa kamar firewall amma tsarin adireshi ne.

Canza umarnin gyara ne a bangaren uwar garke tare da sake kunnawa, kuma yana aiki ga hadin da ke tafe ba wai zaman da aka riga aka bude ba. Sake hada abokan ciniki kafin ka tantance canjin. Idan na'ura tana sake samar da tsarin daga fuskar yanar gizo, rubuta umarnin, fayil din da kwanan wata, kuma yi gyaran ta fuskar idan akwai, domin sake gini zai shafe gyaran hannu a ajiye na gaba.

client-to-client wata kofa ce daban

Ko a cikin subnet daya, uwar garke tana watsar da fakitin da suka zo daga abokin ciniki daya kuma aka nufa wa wani, sai idan an saita client-to-client. Wannan kalmar maabudi tana mai da uwar garke mai turawa ga zirga-zirgar 'yan uwa maimakon wurin karshe da ke karbarsa kawai. Ita ce sharadi na biyu da mutane ke mantawa bayan sun gyara yanayin.

Ba ya wuce zuwa watsawa. Saitin yana tura unicast tsakanin abokan ciniki; ba ya mai da tunnel sashin tarayya, kuma babu adadinsa da zai isar da tambayar ganowa ta multicast ga kowane abokin tarayya.

TUN da TAP, da abin da kowanne zai iya dauka

PropertyTUNTAP
LayerLayer 3, IP packetsLayer 2, Ethernet frames
Broadcast and multicastNot carriedCarried
Bridging to the LANNot applicableRequired for a shared segment
Client platform supportEverywhereMissing on Android and iOS, limited on macOS

Gadar na'urar tap cikin LAN tana sanya abokan ciniki na nesa cikin yankin watsawa na ofis, wanda ke warware ganowa gaba daya. Farashin shi ne dandamali da ba sa aiwatar da TAP, gada da dole ta kasance a kan uwar garke, da yankin kasawa inda guguwar watsawa a kan igiyar ofis ke isa kowane kwamfutar tafi-da-gidanka ta nesa.

Ga ayyukan aiki biyu ko uku da ke bukatar warware sunaye, shigar hosts ko adireshin unicast ya fi gada araha. Koma zuwa TAP lokacin da wata yarjejeniya da ba za ka iya maye gurbinta ba ta dogara da ganowar mataki na 2, ba kafin haka ba.

Abokan cinikin subnet daya ba tare da gada ba

Bayar da adireshi daga kewayon LAN ba ya sanya abokin ciniki a kan igiya. Uwar garke tana tafiyar da hanya tsakanin tunnel da Ethernet, don haka ARP na wannan adireshin yana tsayawa a fuskar uwar garke kuma sauran LAN ba su taba sanin inda yake zaune ba.

ip neigh add proxy 10.50.1.250 dev eth0

Proxy ARP yana rufe wannan gibin ta hanyar sa uwar garke ta amsa a madadin abokin ciniki. Ga kewayon, parpd yana kula da shigarwar yayin da abokan ciniki ke zuwa da tafiya, alhali sysctl net.ipv4.conf.eth0.proxy_arp=1 yana amsa duk abin da aka tura wani wuri, wanda ya isa ya haifar da nasa mamakin a wani sashi mai cunkoso.

Duk hanyar da ka zaba, cire NAT daga tsakanin tunnel da igiya. Dokar MASQUERADE tana boye tambayar adireshin da kake kokarin amsawa. Hakanan tana barin mutum na gaba da yanayin da ba zai iya yin tunani a kansa daga bangaren abokin ciniki.

Kafin ka canza wani abu, kama kokari daya a kan uwar garke da tcpdump -ni tun0 ka tabbatar ko fakitin abokin tarayya ya iso ko a'a. Zuwa sannan a watsar da shi yana nuni ga client-to-client; rashin zuwa gaba daya yana nuni ga yanayi ko turawa. Littafin jagora na OpenVPN 2.6 yana rubuta duka kalmomin maabudi biyu da tsohon yanayin, wanda ya cancanci a kwatanta da sigar ka kafin ka kwafa layi daga sakon dandali.

  • Fuskar tun tana nuna mask na wurin ajiya maimakon biyun abokin tarayya na /30.
  • Ping kai tsaye zuwa dayan adireshin tunnel yana yin nasara kafin ka gwada ganowa.
  • Tsarin uwar garke yana hada client-to-client duk lokacin da 'yan uwa za su yi musayar fakiti.
  • Ambaci yarjejeniyar ganowa da kake gwadawa maimakon cewa manhajar ta kasa.
  • Yi amfani da TAP kawai idan kowace dandamalin abokin ciniki a kungiyar tana goyon bayansa.
  • Ka nisantar da NAT daga hanyar tsakanin tunnel da LAN lokacin da isa ga juna a cikin subnet daya ke da muhimmanci.

Labarai masu alaƙa