Adireshin peer na PPP ko ƙarshen VPN: wanne ke shiga via

Layi ɗaya a kan interface PPP yana warware yawancin muhawarar hanya a kan akwatin VPN: adireshin ciki da peer ɗin da aka buga a gefensa. Karanta wannan biyun a matsayin ƙaramin subnet kuma za ka nemar da ƙofa da ba ta wanzu. Karanta shi a matsayin ƙarshen haɗi ɗaya kuma mataki na gaba zai bayyana. Kwatancin a nan yana tsakanin waɗannan karatu biyu, domin kowane tebur da aka gina daga baya yana gado wanda ka zaɓa. Babu abin da ya shafi ƙarshen VPN na waje da kowanne daga cikinsu ke yankewa.

Karatu biyu na layin interface guda

Ɗauki zaman da interface ke bayar da rahoton inet 10.64.3.9 peer 10.64.3.1/32. Karatun subnet yana ɗaukar 10.64.3.9 a matsayin mai masauki shi kaɗai a tsibirin /32 sannan yana neman na'urar hanya don isa wani abu bayansa. Tun da kawai sauran adireshin da ke kan hanyar haɗi shine peer, wannan karatun yana ƙarshe da ba da shawarar 10.64.3.9 kansa a matsayin ƙofa, wanda yake da'ira.

Karatun ƙarshe shine wanda aka rubuta. A kan interface na aya-da-aya, peer yana ambaton ƙarshen nesa na wannan haɗi ɗaya, saboda haka 10.64.3.1 shine mataki na gaba da za a iya amfani da shi kuma 10.64.3.9 kullum adireshin tushe ne kawai.

Wannan bambanci yana ƙayyade abin da zai iya kasancewa a cikin via. Rubuta adireshin gida a can yana samar da hanya da kernel ba zai iya warwarewa ga maƙwabci ba, saboda haka shigarwar ko ta kasa tabbatarwa ko kuma ta haɗiye zirga-zirga yayin da take kama da lafiya sosai a cikin jeri. Peer yana aiki domin shine ainihin wurin zuwa a kan haɗin. Duka karatun biyu sun yarda game da ƙarshen VPN na waje, wanda shine asalin daban gaba ɗaya: ana isa gare shi ta underlay, ba ta rami da yake ƙarewa ba.

Abin da zaman ya riga ya shigar

Kafin ka rubuta kowane tebur naka, buga abin da ya zo tare da haɗin. Haɗin PPP da aka goyi bayan yawanci yana shigar da hanyar na'ura da hanyar peer yayin saita zaman, kuma waɗannan shigarwar biyu sun riga sun rubuta karatun daidai.

ip -4 addr show dev ppp0
ip route show dev ppp0
ip route show table main | head -n 5

Hanyar na'ura kamar 10.64.3.1 dev ppp0 proto kernel scope link src 10.64.3.9 ba ta ɗauke da ƙofa domin interface ɗin kanta ita ce hanya. Hanyar da ke ambaton peer da via wani abu ne daban da wani rayuwa dabam, kuma tana ɓacewa lokacin da zaman ya faɗi. Kwafin ɗaya daga cikin siffofi biyu zuwa tebur mai ɗorewa ba tare da duba yadda ake sake shigar da shi ba shine dalilin da ya saba sa rami mai aiki ya rasa hanyarsa bayan sake haɗawa.

Kwatanta jerin biyu maimakon dogara ga ƙwaƙwalwa. Idan hanyar peer tana cikin main amma ƙarin teburinka fanko ne, ka koyi wani abu da layin adireshin bai taɓa gaya maka ba.

Ƙa'ida da tebur shawarwari ne daban

Zaɓin tebur da cika shi matakai ne masu zaman kansu, kuma kwatancin yana da mahimmanci a nan domin ana rikita su biyu a lokacin gyara kuskure. Ƙa'idar da ke aika zirga-zirgar da aka yi wa alama zuwa tebur 100 ba ta yin komai idan tebur 100 ba shi da hanyar da ta dace, kuma tebur da aka cika da kyau ba a isa gare shi idan babu ƙa'idar da ke nuna masa.

Rabin hanyar da aka saba ba ita ce hanyar da aka saba ba. Ɗaya 0.0.0.0/1 yana rufe rabin ƙasan sararin IPv4, saboda haka manufar da ke niyya kama komai tana buƙatar 128.0.0.0/1 da ya dace, ko kuma default na gaske. Karanta tsarin da ke aiki da kwafin ɗaya daga cikin rabin biyu shine yadda mutane ke ƙarshe da madauki na hanya wanda ke karyewa kawai a wasu wurare.

Bar keɓancewar da aka yi da gangan don adireshin da dole su kasance a LAN, kuma yanke shawara abin da ke faruwa lokacin da bincike bai sami komai ba a cikin tebur da aka zaɓa. Hanyar ajiya bayyananna ta fi sauƙin yin tunani fiye da tebur fanko, wanda ke mayar da sakamakon da ba a isa ba kuma yana sa aikace-aikacen ya zama kamar ya lalace maimakon an karkatar da shi.

Tambayi binciken tambayar da aikace-aikacenka ke yi

ip route get yana warware hanya; ip route show yana lissafin shigarwar da aka adana, kuma duka biyu na iya samun sabani ba tare da ɗayansu ya yi kuskure ba. Haɗa mahallin tushe, domin ƙa'idojin da suka dogara da tushe suna daidaitawa ne kawai lokacin da bincike ya ɗauki tushe.

ip route get 198.51.100.23 from 10.64.3.9
ip route get 198.51.100.23 from 10.64.3.9 iif ppp0
ip -4 rule show

Umarni na farko yana tambayar tambayar daga mai masauki. Na biyu yana ƙara interface mai shigowa, wanda ya fi kusa da abin da zirga-zirgar da aka tura ke fuskanta, kuma amsar tana nuna wani tebur. Babu ɗaya daga cikin wuraren da ke hidimar gwaji kai tsaye; 198.51.100.23 adireshin takardu ne, saboda haka maye gurbinsa da mai masaukin da aka ba ka izinin bincika.

Ko da daidaitaccen bincike yana tabbatar da cewa an zaɓi hanya ne kawai. Bai ce komai ba game da ko ɓangaren nesa yana karɓar zirga-zirgar ko amsar na iya dawowa ta wannan tunani.

Inda kwatancin ke juyawa

Zirga-zirgar mai masauki da zirga-zirgar da aka tura ba wai kawai suna yin bincike daban ba; suna fuskantar matattara daban a hanyar dawowa. Linux yana amfani da tabbatarwar hanyar baya ta hanyar mafi tsanani daga saitunan dukkan interfaces da interface mai karɓa, saboda haka canza darajar interface ɗaya na iya zama ba shi da tasirin da ake gani. Hanyar da ta dogara da alama tana ƙara dangantakar src_valid_mark, inda alamar dole ta dace domin a ɗauki tushe a matsayin ingantacce.

Idan amsoshi suka ɓace yayin da hanyar fita ke kama da daidai, karanta darajoji masu tasiri kafin ka taɓa su, kuma canza su kawai da wani dalili na manufa da aka bayyana.

sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.ppp0.rp_filter
sysctl net.ipv4.conf.all.src_valid_mark

Zaɓi tsakanin ƙira biyu bisa hujja: idan aikace-aikacen ya ɗaure da adireshin PPP, ƙa'idar tushe da tebur mai ɗauke da hanyar peer sun isa. Idan akwatin yana turawa don LAN da ke bayansa, kana buƙatar mahallin shigowa da hanyar dawowa su yarda. Idan ba su yarda ba, gyara mallakar hanyar maimakon sassauta tabbatarwa ga dukan injin.