Adireshin VPN da hayar DHCP ta LAN: wa ya ba da IP na rami?

Haɗa abokin ciniki ka duba adafta maimakon alamar Wi-Fi. Adireshi kamar 10.80.0.14 na iya kasancewa a kan rami alhali babu uwar garken DHCP a LAN ɗin ofis da ya taɓa rubuta wannan haya. Wanda ya zaɓi lambar ne ke ƙayyade inda binciken matsala zai fara.

A wurin abokin ciniki komai ya yi kama: adireshin IPv4 ɗaya, abin rufe fuska ɗaya, wani lokacin ƙofar da aka saba. Bambanci yana bayyana ne kawai idan ka tambaya wa ke amsa wannan adireshin kuma wa ke riƙe da rikodin sa.

Karanta adireshin rami daga ɓangaren abokin ciniki

Windows yana nuna bambancin idan ka karanta dukan ɓangaren ba layin farko ba. ipconfig /all yana buga bayanin adafta, adireshin jiki da layin DHCP. Adaftan kira na PPP ko IKEv2 yakan bayar da rahoton cewa DHCP a kashe yake, domin haɗin ya tattauna adireshin sa a lokacin kira maimakon ya hayar da shi daga uwar garken LAN. Adaftan rami mai kunna DHCP abu ne da ba a saba gani ba kuma ya cancanci bincike daban.

Linux yana raba wannan bayanin a kan kayan aiki biyu. ip -4 addr show dev tun0 yana ba da adireshin da tsawon prefix. nmcli -f IP4 connection show work yana bayyana ko darajar ta fito daga bayanin haɗin, musayar DHCP a kan hanyar, ko tsarin da aka tura. WireGuard shi ne mafi bayyanan misali, domin wg-quick yana amfani da layin Address daga fayil ɗin tsari lokacin da interfey ɗin ya bayyana kuma babu abokin da ke ba da wani abu a lokacin haɗi.

Prefix ɗin ma yana faɗin wani abu. /32, ko abin rufe fuska na 255.255.255.255, yana nufin ƙofar tana tsammanin yin hanya zuwa adireshin mai masauki ɗaya, yayin da faffadan abin rufe fuska ke nuna wani yanki na gida a kan hanyar a wani wuri bayan rami.

Abin da kayan tsarin IKEv2 ke ɗauka

IKEv2 yana da hanyar da aka keɓe don wannan aiki. Kayan tsari da aka bayyana a RFC 7296, sashe na 3.15.1 yana ɗauke da halaye kamar INTERNAL_IP4_ADDRESS, INTERNAL_IP4_NETMASK, INTERNAL_IP4_DNS da takwarorinsu na IPv6. Abokin ciniki yana aika sifa da daraja mai tsawon sifili idan ba shi da zaɓi, kuma mai amsa yana mayar da darajar da yake so a yi amfani da ita. Wannan musayar tana tafiya cikin IKE_AUTH, wanda aka riga an ɓoye shi, don haka babu watsa DHCP da ke ƙetare rami.

Sakamako biyu sun biyo baya. Na farko, mai amsa ne ko duk wani bayanan izini da yake tuntuɓa ke zaɓar adireshin, shi ya sa tafki zai iya zama a ƙofar, a cikin amsar RADIUS, ko a cikin taswirar mai ba da shaida. Na biyu, sifar DNS ta bambanta da sifar adireshi. Samun 10.80.0.14 ba ya faɗin komai game da wace mai warwarewa ta dawo, ko ta dawo kwata-kwata.

Sifar abin rufe fuska na cibiyar a aikace na zaɓi ne. Yawancin turawa suna mayar da adireshi kawai kuma suna barin abokin ciniki ya shigar da hanyar mai masauki, shi ya sa tafki ɗaya zai iya kama da /32 a wani abokin ciniki da /24 a wani.

Inda yankin DHCP na LAN da tafkin VPN suka yi karo

Matsala tana farawa lokacin da duka masu bayarwa suka nuna yanki ɗaya. Uwar garken DHCP na 10.20.30.0/24 bai san komai ba game da tafkin VPN da aka tsara don 10.20.30.128/25, don haka babu abin da zai hana shi hayar da 10.20.30.140 ga firinta yayin da ƙofar ke ba da wannan adireshin ga abokin ciniki na nesa. Haɗuwar tana yin shiru kwanaki sannan ta bayyana a matsayin kwafi na lokaci-lokaci.

Tsarin hanya daga wuri zuwa wuri yana guje wa haɗuwar ta hanyar gini. Mai masauki a reshe yana riƙe da adireshin da uwar garken DHCP na gida ya ba shi. Hanyoyin rami a kan ƙofofin biyu suna ɗauke da adiresoshin haɗin nasu, kuma teburin hanya ne ke ƙayyade yadda fakiti ke tafiya. Adiresoshin abokan ciniki na shiga nesa rukuni na uku ne kuma bai kamata a haɗa su da adiresoshin haɗin ƙofar ba.

Yin gada da ramin zuwa LAN yana kawar da wannan rabuwa. Idan tsarin yana buƙatar yankin watsawa ɗaya da gaske, ƙarshen VPN dole ne ya shiga cikin shawarwarin bayarwa iri ɗaya da uwar garken DHCP, ta hanyar relay ko tushen iko na tarayya, maimakon ya bayar da adireshi da kansa.

Tabbatar da wace tsari ce ta mallaki adireshin

Tabbatar da mallaka kafin ka canza yanki. A wurin abokin ciniki, rubuta adireshin da prefix. A LAN, bincika cikin rumbun hayar. A ƙofar, jera tafkunan da aka tsara ta don bayarwa. Adireshin da aka samu a fayil ɗin haya na uwar garken DHCP ne, wato an yi gada ko relay na ramin; adireshin da aka samu kawai a tafkin ƙofar na ƙarshen ramin ne.

# client: address and prefix on the tunnel interface
ip -4 addr show dev tun0

# LAN DHCP server: is this address leased to anyone?
grep -c '10.80.0.14' /var/lib/dhcp/dhcpd.leases

# gateway: pools that remote-access clients draw from
sudo swanctl --list-pools

Rubuta abubuwa huɗu da zarar amsar ta bayyana: wace sassa ce ke ba da adireshin abokin ciniki, wace yanki aka tanada dominsa, yadda zirga-zirgar dawowa ke isa wannan yanki, da waɗanne albarkatu ke karɓe shi. Waɗannan shigarwar huɗu suna mai da layin adaftan kama-da-wane ya zama gaskiyar aiki.

Maimaita binciken sifar DNS yayin da kake wurin. Tafkin da ke ba da adireshi amma babu mai warwarewa yana barin abokin ciniki a kan DNS ɗin gida, wanda ya bambanta da gazawar tafkin da ke ba da adireshin da LAN ke amfani da shi tuni.