Me yasa VPN ɗinka ke faɗuwa lokacin da Wi-Fi ya canza ko an saka Ethernet

Ana ba da rahoton abubuwa biyu a matsayin gazawa ɗaya: kwamfutar tafi-da-gidanka ta koma wata cibiyar Wi-Fi, ko kuma an saka kebul yayin da Wi-Fi ya kasance a kunne. Client ɗin har yanzu yana cewa an haɗa, alamar tana da kyau, kuma tunnel ɗin ba ya ɗaukar kome. A ƙasa, sassa uku ne kawai na yanayi za su iya motsawa - haɗin, adireshin gida, hanyar da aka saba - kuma wanda ya motsa shi ne ke yanke shawara ko tunnel ɗin zai warke da kansa ko yana buƙatar sake haɗawa. Ina duba su a wannan tsari, domin canza saitin asusu bai taɓa gyara ɗaya daga cikinsu ba.

Haɗi, adireshi da hanya suna motsawa dabam

Motsi tsakanin wuraren shiga a cibiyar ɗaya yawanci al’amari ne na L2. Rediyo yana sake haɗawa, interface ɗin yana riƙe adireshinsa da ƙofarsa, kuma babu abin da tunnel ɗin ya dogara da shi da ke canzawa, shi ya sa tafiya a cikin babban ofis wani lokaci ba a lura da ita. Shiga wani SSID ba haka ba ne: tsohon interface ɗin na iya faɗuwa, DHCP yana ba da sabon adireshi, sabuwar ƙofa da sababbin masu warwarewa, kuma kwararar waje da tunnel ɗin ke amfani da ita ta daina wanzuwa.

Ethernet yana ƙara siffa ta uku. Wi-Fi ba ya faɗuwa, don haka babu wani al’amari na haɗi da ke tashi, amma interface ɗin waya yana bayyana da adireshinsa kuma sau da yawa yana cin hanyar da aka saba bisa ma’auni. Tunnel ɗin yana ci gaba a kan hanyar da ba a fi so ba, ko kuma client ɗin yana riƙe socket ɗinsa a manne da hanyar mara waya da ya fara a kanta. Daga browser ɗin duka biyu suna kama: shafuka suna tsayawa a daidai lokacin da kebul ɗin ya shiga.

Don haka tambaya ta farko ba ita ce ko Wi-Fi ya canza ba. Ita ce ko adireshin da kake manne da shi, ko hanyar zuwa ƙarshen, ya canza yayin da tunnel ɗin yake a kunne.

An manne socket ɗin waje da adireshin da ya ɓace yanzu

Kowane tunnel kwarara ne na waje: adireshin gida da tashar jiragen ruwa suna magana da adireshin uwar garke da tasharta. A Linux wannan socket ne na UDP da aka ɗaure ga tsohon tushe; idan an cire interface ɗin da ke riƙe adireshin, aikewa ko dai ya kasa da EADDRNOTAVAIL ko ya fita ta sabon interface da tushen da uwar garke ba ta taɓa gani ba.

Bangaren nesa yana riƙe da nasa manne. Ana gane SA na IKEv2 ba tare da MOBIKE ba da nau’in adireshi, kuma OpenVPN zama yana da alaƙa da adireshin abokin da ya koya, kuma taswirar NAT ta adireshin sirri ne, tashar da adireshin jama’a da suka ƙirƙire ta. Motsa zuwa bayan wani NAT kuma kowace amsa ana aika ta zuwa taswirar da ba ta wanzu. Babu abin da ba daidai ba a na’urarka; biyar-biyar tana nuni ga cibiyar da ka bar.

Karanta yanayin kafin yin hasashe:

• ss -unp yana nuna adireshin gida da tashar da kowane socket na tunnel ke riƙe da gaske.
• ip route get 203.0.113.10 yana buga adireshin tushe da na’urar da kernel zai yi amfani da ita don ƙarshen a yanzu.
• wg show wg0 endpoints, swanctl --list-sas ko log ɗin client yana nuna adireshin abokin da bangaren nesa ke tsammanin yana magana da shi.

Idan adireshin socket da binciken hanya ba su daidaita ba, ka sami karyewar, kuma babu wani canjin takardun shaidar da zai taɓa shi.

Abin da kowace ka’ida ke yi da sabon adireshin tushe

Client ɗin suna shan canjin a matakai daban-daban, kuma tebur ɗin shi ne abin da nake kwatanta da saitin client ɗin maimakon yin hasashe daga halin sake haɗawa.

Dokar motsi ta WireGuard tana aiki ne kawai a gefe ɗaya: dole client ɗin ya fara aikawa daga sabon adireshin. Socket ɗin da har yanzu ke manne da tsohon interface ba ya yin haka, shi ya sa tunnel zai iya kama da rai yayin da lokacin musafaha yana tsufa. bayanin ka’idar yana faɗin yanayin sabunta ƙarshen daidai, kuma ya cancanci karantawa kafin ka canza wani saiti.

Ana tattaunawa da MOBIKE, ba a ɗauka ba. Idan uwar garke ba ta bayar da shi ba, dole client ɗin ya sake kafawa, kuma wannan gaskiya ce da kake tabbatarwa daga jerin SA ko log ɗin, ba abin da kake fita da shi daga wata dabara mai juyawa ba.

Son hanyar ita ce ke yanke hanyar, ba alamar Wi-Fi ba

Da duka interface biyu a kunne, kernel yana zaɓe bisa ma’auni da tsawon prefix. ip route show default yana lissafa ’yan takarar kuma ip route get 203.0.113.10 yana warware ainihin shawarar, ciki har da adireshin tushe. Hanyar da aka saba ta waya a ma’auni 100 da ta mara waya a 600 suna nufin ƙarshen yana motsawa a lokacin da kebul ɗin ya zauna, yayin da kowace manhaja da ta buɗe socket a baya tana riƙe da tsohon tushenta.

Windows yana yin haka da ma’aunan interface na atomatik, wanda saurin haɗi ya karkatar da shi. Get-NetRoute -DestinationPrefix 0.0.0.0/0 yana jeranta ’yan takarar kuma Find-NetRoute -RemoteIPAddress 203.0.113.10 yana mayar da interface da tushen da stack ɗin zai zaɓa. Client ɗin da ya ɗaure socket ɗinsa na waje ga interface ɗaya yana ci gaba da amfani da shi bayan ma’aunin ya juya; wannan shawara ce ta ɗaurewa, ba laifin tafiyar da hanya ba.

Android yana bayyana rabuwar: ConnectivityManager yana ba da rahoton cibiyoyin da ke akwai da wani na daban na abin da aka saba, kuma manhajar VPN da ta ɗaure socket ga abin Network tana riƙe da wannan ɗaurin har sai ta sake ɗaurewa. A macOS, scutil --nwi yana buga babbar interface da tsarin da injin zai yi amfani da shi.

DNS, MTU da IPv6 suna motsawa tare da haɗin

Sabuwar haɗi tana kawo sababbin masu warwarewa. Da systemd-resolved DNS na kowane haɗi ne, resolvectl status yana nuna wace haɗi ce ke amsa suna, kuma cibiyar baƙi da ke bayar da nata mai warwarewa tana iya barin DNS ɗin da tunnel ya tura ba a yi amfani da shi ba har sai an sake fifita haɗin. Ƙofar da ke kama tana ƙara muni: ƙofar ce ke amsa buƙatar HTTPS ta farko maimakon ƙarshen, kuma client ɗin yana rubuta uwar garke da ta mutu.

MTU na hanya shima yana canzawa. Ethernet da Wi-Fi galibi suna ɗaukar 1500 byte, PPPoE 1492, kuma haɗin wayar hannu sau da yawa ƙasa da haka. Tunnel ɗin da ya gaji ƙaramin MTU yana tsayawa kan manyan fakiti yayin da ƙananan buƙatu ke yin nasara, wanda ake karantawa a matsayin haɗin da ya karye rabi. ping -M do -s 1472 203.0.113.10 yana aika fakitin byte 1500 da DF a saita; shiru yana nufin hanyar ta fi ƙarancin da ka zato.

IPv6 shine ɗayan rabin. Cibiyar da ke bayar da sabon prefix tana canza tushen da client mai matakai biyu zai yi amfani da shi, kuma tunnel ɗin v4 kawai yana barin zirga-zirgar v6 a waje har sai manufar ta biyo baya. ip -6 route show default da ip -6 addr show suna amsa ko sabuwar haɗi tana da hanyar v6 kwata-kwata.

Sake yin miƙaƙɓarin maimakon kwatanta shi

Zaɓi buƙata ɗaya marar lahani ka gudanar da umarni uku ɗin a kowane gefen canjin: ip -br addr, ip route show default, ip route get 203.0.113.10. Sannan ka duba ko tunnel ɗin har yanzu yana fitar da fakiti - tcpdump -ni any udp port 51820 don WireGuard, tashar da ta dace don kowane abu daban. Fakitin da ke fita daga tsohon tushe suna nufin matsalar ɗaurewa. Fakitin da ke fita daga sabon tushe ba tare da amsa ba suna nufin bangaren nesa ko NAT ɗin da ke tsakani.

Lura wane al’amari ya zo daidai da gazawar farko: faɗuwar haɗi, canjin adireshi, ko canjin hanyar da aka saba. Waɗannan suna nuni ga masu daban-daban - client ɗin da dole a sake ɗaurewa, adireshin da dole a sake samu, ko hanyar da ta ke na fayil ɗin saiti ba na dokar kaucewa ta dindindin ba.

Kafin ka ce an gyara, tabbatar da toshewar zirga-zirgar kai tsaye tana nan har yanzu a cikin ratar kuma ana warware sunaye ta sabuwar haɗin. Idan client ɗin yana riƙe da tsohon ƙarshen bayan sauya, gyara saitin motsi ko float da farko. Idan yana motsi daidai kuma har yanzu ba ya samun amsa, duba asalin abokin uwar garke da NAT ɗin da ke kan hanya, kuma ka ajiye yanayin cibiyoyin biyu a cikin rubutun domin na gaba ya iya kwatanta su.