Tsara IPv6 don cibiyar WireGuard ta rukunai biyu: prefix, peers, hanyoyi

LAN biyu, cibiyar WireGuard ɗaya da tsarin adireshin IPv6 wanda dole ya amsa tambayoyi uku daban-daban: wace prefix, wane adireshi na kowane router, da wace peer ce ke da wace subnet. Idan ɗaya daga cikinsu ya yi kuskure, za a sami tunnel da ke yin musafaha kuma ba ya tuƙa komai. Tsarin da ke ƙasa yana bin tsarin sirri na rukuni biyu a wannan jeri. Da gangan ba ya ba da hanyar shiga intanet ta IPv6.

Yanke shawara game da abin da prefix ɗin yake don

Prefix na gida na musamman daga fd00::/8 shine zaɓi na halitta lokacin da manufar ita ce isa ta sirri tsakanin rukunai. Yana dawwama ba tare da la'akari da wane ISP ke hidimar kowane wuri ba, kuma ba a sanar da shi a cikin teburin tuƙi na duniya ba, don haka ba zai iya fitar da lambobin ciki naka zuwa intanet ba.

Wannan siffa ɗaya ita ce iyaka. ULA ba ya ba da hanyar dawowa ta jama'a, domin babu wani upstream da ya san ya tuƙa shi zuwa ƙofar shigarka. Idan buƙatar ta haɗa da fita intanet ta IPv6, kana buƙatar rabon da aka yi daga mai bayarwa wanda ke tuƙa shi zuwa gare ka, kuma wannan yanke shawara ce ta ƙira daban tare da girman prefix nata.

Kada ka ɗauka kowane turawa yana buƙatar /48. RFC 6177 ya nisa daga girman ƙarshen rukuni guda ɗaya na wajibi, kuma girman da ya dace ya dogara da adadin cibiyoyin da za ka gudanar. Ƙirƙiri ULA da hanyar RFC 4193 maimakon ƙirƙira prefix wanda wata ƙungiya ma za ta iya amfani da shi. Rubuta sakamakon cikin tsarin adireshi kafin a daidaita kowace na'ura, domin prefix da babu wanda ya rubuta shi prefix ne da wani zai sake amfani da shi.

Raba prefix ɗin zuwa ayyuka

Misalin da ke ƙasa yana amfani da fd7c:2e91:4a00::/48, kuma an tsara tebur ɗin bisa inda ake rubuta kowane block maimakon bisa rukuni. Ɗauki ƙimar a matsayin misali ka ƙirƙiri naka kafin ka tura wani abu.

Block ɗin LAN /64 ne domin SLAAC na yau da kullum yana buƙatar mai gano fuska mai bit 64. Raba LAN zuwa ƙaramin block yana karya wannan zato a yawancin hosts, kuma kuɗin aiki bai cancanci ajiyar adireshi ba a cikin tsarin sirri. Dukan block ɗin LAN sun fito daga tsakiyar /48, wanda ke barin ƙananan kewayon a buɗe don rukunai na gaba.

Adiresoshin tunnel rumbun ajiya ne na gudanarwa, ba cibiya kan hanyar haɗi ba. Kowace fuska tana samun /128 ɗaya daga ciki, don haka babu host da ke ɗauka cibiya ce da aka raba a kan tunnel kuma ba a gudanar da binciken maƙwabta inda ba a buƙata. Ka riƙe ayyukan daban kuma ka rubuta su cikin tsarin adireshin ƙungiyar don kada wani rukuni na gaba ya sake amfani da block.

Ba kowace router adireshin tunnel ɗaya

Ba da /128 ɗaya ga kowace router ka kuma riƙe maɓallan da wuraren ƙarshe na cibiyar da ke aiki. Ƙimomin uku da ke ƙasa sun bambanta ne kawai a ɓangaren host.

Hub:    Address = fd7c:2e91:4a00:ff00::1/128
Site A: Address = fd7c:2e91:4a00:ff00::2/128
Site B: Address = fd7c:2e91:4a00:ff00::3/128

Wannan /128 yana bayyana adireshin guda ɗaya da aka ba wa wannan fuska. Ba ya faɗi komai game da adadin wuraren da peer zai iya tuƙawa, domin ana bayyana isa cikin AllowedIPs maimakon a cikin prefix ɗin fuska.

Kowace router ɗin rukuni kuma tana buƙatar adireshi a cikin block ɗin LAN nata da hanyar rarraba shi, yawanci sanarwar router don SLAAC. WireGuard ba ya aika waɗannan sanarwar a madadin ka, kuma ba ya haɗa LAN biyun. Router ɗin rukuni router ne a duka kwatance.

Saka mallakar subnet a cikin AllowedIPs

Shigarwar peer na cibiyar don Rukuni A tana da adireshin tunnel na A da LAN na A, kuma wannan biyun shine dukan bayanin mallaka. Babu wani abu a wannan sashe na peer da ke buƙatar bayyana rukuni.

AllowedIPs = fd7c:2e91:4a00:ff00::2/128, fd7c:2e91:4a00:10::/64

Shigarwar peer na Rukuni B tana da biyun da ya dace, kuma daidaito a nan ya fi gajeren magana muhimmanci. Karanta layukan biyu tare kuma za ka ga rabon mallaka a kallo ɗaya.

AllowedIPs = fd7c:2e91:4a00:ff00::3/128, fd7c:2e91:4a00:20::/64

Waɗannan sassa biyu ne na peer daban, ba jerin biyu da ke gasa kan peer ɗaya ba. WireGuard yana amfani da AllowedIPs a duka kwatance: yana zaɓar peer don waje mai fita, kuma yana ƙin fakitin da ke shigowa wanda tushensa bai dace da kewayon da aka ba wa peer ɗin da ya buɗe shi ba. Ba da dukan /48 ga duka peers zai kashe wannan bincike na biyu kuma ya ɓata wane rukuni ke da wane block. Wannan bambanci ne ke sa kuskuren adireshin tushe ya bayyana maimakon a karɓe shi a shiru.

Kowane rukuni yana buƙatar kawai wuraren da ake iya isa ta hanyar peer ɗin cibiyarsa: Rukuni A yana lissafa adireshin cibiyar, adireshin tunnel na Rukuni B da LAN na B, kuma Rukuni B yana lissafa saitin da ya saba. Jerin ba daidai suke da gangan ba, domin kowace router tana ganin wani gefen topology daban. Rubuta duka biyun daga tsarin adireshi ba daga saitin rukunin ɗaya ba, domin haka ne wani kewayon da ya tsufa ke tsira daga sake lambobi.

Da wg-quick, waɗannan kewayon ma suna ƙirƙirar hanyoyi. Da systemd-networkd ko saitin hannu, ƙara hanyoyin da suka dace da kanka; in ba haka ba tunnel ɗin yana ɗaukar fakiti waɗanda kernel ba ya taɓa turawa ciki.

Kammala wucewa ka gwada duka kwatance

Kunna wucewar IPv6 a kan cibiyar da kan duka router ɗin rukunai, kuma ka ba da izinin ayyukan tsakanin rukunai da ake buƙata a manufar wucewa. Ka riƙe saƙonnin ICMPv6 Packet Too Big suna da amfani, domin zubar da su yana karya gano MTU na hanya kuma yana haifar da tsayawar jigilar manyan abubuwa da suke kama da kuskuren manhaja. Cibiyar da ke wucewa ba tare da izinin katangar wuta ba tana zubar da fakitin tsakanin tuƙi da tunnel. Wannan yanayin gazawa ya cancanci a sani, domin tunnel ɗin yana nan kuma wasu magudanan ne kawai suke mutuwa.

sysctl net.ipv6.conf.all.forwarding
ip -6 route
ping -6 -c 3 fd7c:2e91:4a00:20::1

Gwada daga host a Rukuni A zuwa host a Rukuni B sannan a kishiyar kwatance. Ping zuwa adireshin tunnel na cibiyar yana gwada matakin farko ne kawai kuma zai wuce ko da hanyoyin LAN ba su dace ba. Magudanar host-zuwa-host ita ce ke tabbatar da tsarin.

Haɗin WireGuard na waje zai iya gudana a kan IPv4 yayin da cikin zirga-zirgar IPv6 ne, kuma wannan 'yanci yana da amfani lokacin ƙaura. Idan an ƙara fitar IPv6 na duniya daga baya, sake duba rabon mai bayarwa, zaɓin adireshin tushe da tuƙin dawowa a matsayin sabon matakin ƙira; tsarin sirri na sama yana nan da inganci don zirga-zirgar tsakanin rukunai.