Me ya sa wani yanki ɗaya har yanzu ke ƙetare babbar hanyar VPN ɗinka

Kuna canza VPN zuwa cikakken tunnel, yawancin zirga-zirga suna biyayya, sannan adireshi ɗaya ya amsa kai tsaye — firinta, NAS, mai tsalle a kan 10.x. Fassarar bayyane ita ce tunnel ɗin yana zubewa, don haka kuna rage ma'aunin babbar hanya kuma babu abin da ke canzawa. Wannan yunƙurin da ya kasa shi ne alamar: babbar hanya ita ce madadin, ba hukunci ba. Binciken hanya yana ɗaukar mafi dadewar prefix da ya dace kafin ya taɓa kwatanta ma'auni, don haka /24 na ci gaba da cin nasara a kan /0 ko wace lamba ka haɗa da kowannensu. Da zarar wannan tsari ya bayyana, zubewar yawanci hanya ce da wani ya sanya da gangan, ko prefix da abokin ciniki bai taɓa nufin rufewa ba.

Abin da babbar hanya ta gaske ke yi alkawari

0.0.0.0/0 yana dacewa da kowace manufa ta IPv4 da sifili bit na ƙayyadaddun. Yana wanzu domin mai masauki ya isa duk abin da teburinsa bai kwatanta shi da kyau ba. Hanya zuwa 192.168.1.0/24 tana ɗaukar 24 bit masu dacewa, don haka ga 192.168.1.40 tana cin nasara kafin kowa ya kwatanta ma'auni, nisan gudanarwa ko duk abin da abokin ciniki ya kira filin fifikinsa. Wannan ka'ida ɗaya tana aiki a Linux FIB, teburin tafiyar da Windows da BSD stack bayan macOS.

A kan LAN ta al'ada wannan ɗabi'a siffa ce. Ƙananan yankin yana haɗe kai tsaye, firintar na ci gaba da aiki yayin da tunnel ke ɗaukar bincikenka, kuma babu abin da ba daidai ba. Tambayar da ta cancanci yi ba ita ce me ya sa wannan adireshin ke tafiya kai tsaye ba, amma wace prefix a wane tebur ne ya dace da shi, kuma wa ya sanya shi a can.

Rabin-tushiyoyi, ko me ya sa shigarwar da aka saba iya kamar ba a taɓa ta ba

Mafi tsaftataccen misali shi ne redirect-gateway def1 a OpenVPN. Maimakon share tushiyarka ta asali da maye gurbinta, yana ƙara 0.0.0.0/1 da 128.0.0.0/1. Tare biyun suna rufe duk IPv4, kowane prefix ya fi /0 tsawo, kuma dukansu suna cin nasara a kan tushiyar router yayin barin ta a wurinta. Gudanar da jerin tushiyoyi bayan haka kuma ainihin tushiyar tana nan, har yanzu tana nuni ga ƙofarka; kawai ba a taɓa zaɓen ta don wuraren intanet ba.

wg-quick na WireGuard yana kaiwa ga wannan sakamakon ta hanyar tafiyar da manufa. Idan AllowedIPs ya rufe 0.0.0.0/0 yana ƙirƙirar teburinsa, yana aika fakiti masu alama zuwa can, kuma yana ƙara doka da ke watsi da prefix mai tsawon sifili na babban teburi. Babban teburi yana riƙe da shigarwarsa ta asali, kuma dokoki suna yanke hukunci cewa ana tuntuɓar teburin tunnel da farko don zirga-zirgar da interface ke mallaka.

Dukansu ƙirar biyu suna buƙatar tushiya ɗaya tak a wajen tunnel: tushiyar mai masauki zuwa adireshin uwar garken VPN kanta ta ainihin ƙofa. Idan babu ita, abokin ciniki zai yi ƙoƙarin ɗaukar fakiti da ke gina tunnel a cikin tunnel, kuma haɗin ba zai taɓa kammala ba. Don haka tushiyar da ba ta tunnel a teburinka ta al'ada ce ko da a tsantsar bayanin martabar cikakken tunnel. Tushiyoyin da suka cancanci tambaya su ne waɗanda ke rufe wuraren da kake da muhimmanci da gaske.

Ma'auni suna yanke hukunci kan daidaito, prefix ne ke yanke hukunci kan masu nasara

Ana kwatanta ma'auni ne kawai tsakanin 'yan takara da suka dace da manufa daidai. A Linux, ip route get 10.20.5.9 yana buga wanda ya yi nasara tare da teburinsa, kuma ip route show table all yana jera 'yan takarar, ciki har da kowane rabin-tushiye da kowane teburi da doka ke nunawa. A Windows, Find-NetRoute -RemoteIPAddress 10.20.5.9 yana mayar da tushiyar da aka zaɓa da adireshin tushe, yayin da Get-NetRoute ke nuna teburin danye — amma kuɗin da ya dace shi ne ma'aunin tushiya da ma'aunin interface, don haka jinkirin adafta na iya rasa daidaiton da ya ga kamar yana cin nasara.

Abubuwa uku ne ke rufe yawancin abin da za ka gani:

• Manufa ɗaya, /24 a kan /0: /24 na cin nasara kan tsawon prefix, ko me ma'auni suka ce.
• Manufa ɗaya, /24 biyu da ma'auni daban-daban: ƙananan ma'aunin da ya dace yana cin nasara.
• Manufa ɗaya, teburi biyu, ɗaya an zaɓa ta dokar manufa: dokar tana zaɓar teburin da farko, kuma kwatancen prefix yana faruwa a cikinsa.

Halin na uku shi ne inda yawancin waɗannan rahotanni ke ƙarewa. Linux ip rule ko matatar zirga-zirgar VPN ta Windows na iya aika zirga-zirga zuwa teburin da bai taɓa riƙe tushiyar tunnel ba, kuma babban teburi yana kama da cikakke duk lokacin.

Wanene yawanci ke mallakar ƙetarewar

Fara da bayanin martaba, ba teburi ba. Saitunan split-tunnel da saitunan VPN na kowace manhaja da gangan suna barin sunayen prefix a wajen tunnel; bayanin martabar aiki da ke kare wani yanki mai zaman kansa kuma ya bar binciken gabaɗaya ya tafi kai tsaye yana yin daidai yadda aka tsara shi, kuma wuce gona da iri yana karya manufar da aka gina shi don aiwatarwa. Jagorar tafiyar da VPN ta Microsoft tana zana wannan layi ɗaya tsakanin zirga-zirgar da aka tilasta a tunnel da keɓancewar bayyanannu, wanda ke mai da ita bincike mai amfani kafin ka gyara wani abu.

Sannan nemi saura. Tushiyar da ke nuni ga interface da babu kuma, ko adireshin da ya fito daga cibiyar da ta gabata, tana bayyana bayan tashoshin docking, adaftar USB da gadojin kwantena sun zo sun tafi. Share ta sau ɗaya ba shi ne ƙarshe ba: bayanan martabar haɗin NetworkManager, fayilolin netplan da tushiyoyin Windows masu dorewa suna sake sanya ta a haɗin ko tashi na gaba, don haka nemo fayil ko bayanin martabar da ke mallakarta kafin ka gyara wani abu.

Sannan duba IPv6 da kanta. ip -6 route da Get-NetRoute -AddressFamily IPv6 suna riƙe da yanayi daban, tushiyoyi daban da ɗabi'ar abokin ciniki daban. Binciken IPv4 kawai ba ya ce komai game da mai masauki mai stack biyu da ke fifita hanyar IPv6 ta asali a hankali, kuma wannan kaɗai na iya sa abokin ciniki ya yi kama da split-tunnel.

Tabbatar da ainihin tafiyar manhajar

Rubuta manufar da manhajar ke amfani da ita a zahiri, sannan tambayi tsarin hanyar da zai bi daga adireshin tushe da wannan manhajar ke ɗaurewa. ip route get 10.20.5.9 from 192.168.1.40 yana amsa hakan a Linux; Find-NetRoute -RemoteIPAddress 10.20.5.9 da adireshin gida yana yin hakan a Windows. Kwatanta sakamakon da abin da bayanin martabar ke iƙirari. Shafin IP na jama'a na mai bincike yana gwada manufa ɗaya a kan yare ɗaya kuma ba ya ce komai game da adireshin sirri da ya fara ƙarar.

Gyara mafi ƙarancin abu da ke bayyana bambancin. Idan an amince da keɓancewar, rubuta prefix ɗin ka bar shi; idan ba haka ba, cire tushiyar ko ƙara bayyanannen kunkuntar tushiya ta cikin tunnel maimakon rage ma'aunin tasha. Rage ma'auni ba zai iya wuce dogon prefix ba, kuma gyara tasha yayin da tushiyoyi biyu na /1 suka mallaki hanyar intanet shima ba ya canza komai.

Sannan sake haɗa tunnel ɗin kuma maimaita wannan tambayar. Abokan ciniki suna sake sanya tushiyoyi a kowace haɗi, don haka canjin da zai daɗe har zuwa musafaha na gaba ba a gwada shi ba. Idan hanyar har yanzu ta bambanta, waɗanda ake zargi da suka rage su ne dokar manufa, teburi na biyu ko matatar gefen abokin ciniki — ba tashar ba.

• Faɗi manufar da adireshin tushen da manhajar ke amfani da su a zahiri.
• Bugawa tushiyar da ta yi nasara da ip route get ko Find-NetRoute.
• Duba ko /1 biyu ne ko teburin manufa ke mallakar hanyar intanet.
• Jera kowane prefix da ya fi /0 tsawo da ya dace da manufar.
• Maimaita binciken IPv6 daban.
• Bibiyi tushiyar da ta tsira zuwa ga fayil, bayanin martaba ko matatar da ke sanya ta.
• Sake haɗawa ka sake gudanar da tambayar kafin ka kira ta an gyara.

Idan duka bakwai sun yarda da bayanin martabar, tunnel ɗin yana yin daidai abin da aka saita shi don yi, kuma gyaran na cikin bayanin martabar ne ba a ma'auni ba.