Sababta net.ipv4.conf.default.forwarding uusan tun0 taaban

Waxaad dejisay net.ipv4.conf.default.forwarding=1, dib u bilowday VPN-ka, haddana tunnel-ku wali wuu tuurayaa baakadaha gateway-ku waa inuu marsariixyo. Dejinta faylka way u eg tahay mid sax ah, interface-kuna wali wuxuu sheegayaa in gudbinta la damiyay. Waxba ma jabna: waxaad beddeshay qiimaha interface-yada mustaqbalka dhaxli doonaan, ma aha kan tunnel-ka socda isticmaalo.

Tan ku mar host-ka leh tunnel-ka, namespace-ka shabakadda ee tunnel-ku dhab ahaan ku jiro. Weel ama namespace shabadeed ayaa hayn kara interface-ka halka host-ku tuso tirooyin kale.

Akhri saddexda qiimayaal wada

Ku bilow isbarbardhigga switch-ka gateway-ka oo dhan, template-ka interface-yada cusub iyo interface-ka adiga ku quseeya. Ku beddel tun0 interface-ka gelitaanka dhabta ah, oo sidoo kale akhri interface-ka soo noqodka, sababtoo ah gudbinta waxaa lagu qiimeeyaa barta baakadku ku yimaaddo.

sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.default.forwarding
sysctl net.ipv4.conf.tun0.forwarding

Natiijada caadiga ah waa ip_forward = 0, default.forwarding = 1 iyo tun0.forwarding = 0. Labada hore kuma heshiiyaan doorka host-ka, kan saddexaadna wuxuu muujinayaa waxa interface-ku dhab ahaan qabanayo. Isku darkaas wuxuu la jaanqaadayaa host aan waligiis loo habaynin sidii router, oo kaliya la siiyay qiime template. Saddexda tiro iskama hor imaanayaan; waxay ka jawaabaan saddex su'aalood oo kala duwan. Qorista qiimaha template-ka sidoo kale ma go'aamiso doorka host-ka.

Sababta switch-ka caalamiga ah uu is beddelo

net.ipv4.ip_forward waa xakamaynta gateway-ka oo dhan. Beddelkiisu wuxuu cusboonaysiiyaa dejinta gudbinta interface kasta iyada oo qayb ka ah isla hawlgalkaas, sidaas darteed hal qoraal ayaa ka dhigi kara tunnel jira inuu bilaabo gudbinta. default.forwarding wuxuu abuurtaa oo kaliya interface-yada la bilaabo ka dib, marka tunnel hore u jiray wuxuu hayaa qiimihii uu ku dhashay.

Dukumeentiga kernel-ku wuxuu ip_forward u calaamadeeyaa mid gaar ah sabab la xiriirta: beddelkiisu wuxuu dib u dhigaa qayb ka mid ah parametarrada kale ee IPv4 qiimaha caadiga ah ee host ama router. Taas waxay ka dhigtaa qalab qallafsan. In hal mar la dejiyo iyada oo qayb ka ah dhistaanka doorka gateway-ka waa hagaagsan; in si isdaba joog ah loo beddelo sidii khiyaano cilad-baadhis ayaa si aamusan u qori karta habaynta aad waqti u qaadatay.

Qiimayaasha interface kastaa waxay sidoo kale leeyihiin sabab. Gateway si ula kac ah loo maamulo wuxuu ka tageeri karaa gudbinta interface-ka aan waligiis ahayn inuu marsariixyo, xitaa marka host-ku meel kale gudbiyo. Taas ayaa muhiim ka dhigta akhrinta interface-ka socda iyo taas ayaa ka dhigta qiimaha caalamiga ah oo keliya jawaab buuxda ma aha. U akhri ka-reebis sidan oo kale ah go'aan ula kac ah, oo qor sababta interface-kaas uu ka duwan yahay. Haddii kale injineerka xiga wuxuu si naxariis leh u "hagaajin doonaa".

Ka dhig dejinta mid joogto ah meesha saxda ah

Hal mar sysctl -w guuleystay ayaa caddaynaya in kernel-ku aqbalo qiimaha. Ma ku sii noolaan karo dib u bilaabid, mana ku sii noolaan karo maamulaha shabakadda ee dib u xiriirka ku celiya fikradiisa ku saabsan habaynta interface-ka. Ku rid doorka gateway-ka faylka habaynta sysctl ama maamulaha shabakadda leh host-ka, ka dib dib u bilow adeegga ku dabaqaya.

Nidaamka ayaa muhiim u ah tunnel-yada. Haddii maamuluhu sameeyo interface-ka marka la kiciyo oo gudbinta ka dib dabaqo, interface-ku wuxuu dhaxli karaa qiimihii hore. Dib u bilaabista adeeg sameeya tunnel-ka mar kale sidoo kale waa dhacdo abuur, wayna fududahay in la seegto marka unuggu u eg yahay mid caafimaad qaba. Hubi nidaamka, ma aha oo kaliya waxa ku jira faylka ugu dambeeya.

Dib u akhri isla saddexda qiimayaal ka dib marka VPN-ku dib u xiriiro iyo mar kale ka dib dib u bilaabid. Tunnel cusub la abuuray waa interface cusub, interface cusubna wuxuu qaataa qiimaha caadiga ah ee dhaqan galaya waqtiga abuurka. Haddii tirooyinku is beddelaan dhacdooyinkaas dhexdooda, habaynta waxaa dabaqaya wax aadan wali aqoonsan.

Ha ku hagaajin tan qalab khaldan

Markii gudbintu u egtahay mid jaban, damac ayaa ah in firewall-ka la faaruqiyo ama masquerading lagu daro. Midkoodna ma wax ka qabto switch-ka gudbinta. Xaaladda gudbinta, fasaxa gudbinta, waddo loo maro meesha loo socdo iyo waddo soo noqod ayaa ah afar shuruudood oo kala duwan, oo tan ugu horreysa oo keliya ayaa sysctl ah.

Sidoo kale ku tijaabi socodka saxda ah. Codsi lagu sameeyo gateway-ka laftiisa ayaa gudbinta waxba kama baranayo; waa taraafik gudaha lagu abuuray. Su'aashu waa in baakad ka yimaadda macmiil VPN ama host LAN la aqbalo oo loo marsariixyo, sidaas darteed tijaabada waa inay ka bilaabato gadaasha gateway-ka.

Ka sooc kiiska IPv6

Halkan wax walba waa IPv4. Gudbinta IPv6, ogeysiisyada router-ka iyo habdhaqanka accept_ra waxay leeyihiin xakamayn u gaar ah, iyo koobiyeysiga waddo ipv4 dejinta ipv6 wuxuu abuuraa fayl u eg mid la aamini karo oo aan wax faa'iido leh qaban. Gateway leh laba stack wuxuu u baahan yahay in labada qaybood si ula kac ah loo habeeyo.

Hubin ugu dambeysa: ka dib marka qiimayaashu is waafaqaan, xaqiiji in waddada tunnel-ka loo doortay meesha loo socdo iyo in waddada jawaabtu jirto. Gudbinta lagu shiday interface aan waddo lahayn wali waa god madow, cilladaasna dhinaca macmiilka isku mid bay u muuqataa.