EoIP oo dul saaran xiriirka VPN LTE: dhisidda shaybaar yar oo RouterOS

EoIP waxay qaadataa frame Ethernet oo dhamaystiran, waxay ku duubtaa GRE oo waxay u dirtaa ciwaan fog oo la habeeyey, taas aawadeed natiijadu waxay u dhaqantaa sida fiilo ee ma aha sida waddo. Waxa router-ka ka baxa waa borotokool IP 47 oo frame-kii asalka ahaa xambaarsan, sidaas darteed faafinta, ARP iyo borotokoolada aan IP ahayn dhammaantood way gudbaan. GRE ma daro sir gaar ah, frame-kuna wuxuu u ahaanayaa mid la akhriyi karo wax kasta oo arka baakadda dibadda. Xaqiiqdaas keliya ayaa go'aamisa nidaamka shaybaarkan: marka hore dhis waddada sirta ah, ka dibna Ethernet ku qaad gudaheeda.

Waxa EoIP duubto, iyo waxa aanay duubin

Isku-duubidda ayaa ah habka oo dhan. Frame wuxuu yimaadaa deked ku jirta buundada, wuxuu helaa madax GRE iyo madax IP dibadda ah, waxaana loo gudbiyaa router-ka lammaanaha, kaas oo labadaba ka qaada oo frame-ka geliya buundadiisa. Buundada qaadata waxay barataa MAC-ka isha sida ay ka baran lahayd deked maxalli ah. Ma jiro wax ku jira habkaas oo frame-ka xaqiijiya ama qariya.

Sidaas darteed sirta waa inay ka timaaddaa waddada baakadda GRE marto. Naqshaddan, lakabka hoose waa tunnel WireGuard ama IPsec oo u dhexeeya labada router, EoIP-na waxaa lagu qaadaa gudaheeda. MikroTik waxay sidoo kale bixisaa ikhtiyaar IPsec otomaatig ah oo ku yaal interface-ka EoIP laftiisa, taas oo ah hab kale oo aan ahayn waxa shaybaarkan habeeyo.

Adeegyada IP ee la maro, VPN la maro ayaa ah naqshadda yar iyo tan mudan in la doorbido. Lakabka labaad u tag kaliya marka qalabku runtii u baahan yahay inuu arko frame-yada Ethernet ee goobta kale.

Shuruudaha horudhaca: lakab hoose oo sir ah iyo laba deked oo aan la isticmaalin

Labada router waxay u baahan yihiin xiriir sir ah oo la aasaasay iyo ciwaan ku yaal oo lammaanuhu gaari karo. Dhinaca LTE ayaa bilaaba xidhiidhka dibadda, sidaas darteed hub-ku waligiis ma wacdo shabakadda mobaylka, router-ka LTE-na wuxuu hayaa xaaladda NAT ee shirkaddu dalbato. Xaqiiji in tunnel-ku shaqaynayo ka hor intaadan wax ku darin, maxaa yeelay interface EoIP oo aan gaarin ciwaankiisa fog wuxuu u eg yahay mid si khaldan loo habeeyey.

Router kastaa wuxuu sidoo kale u baahan yahay hal deked oo aan hore u ahayn xubin buundo, trunk VLAN, interface maamul ama xiriir wax-soo-saar. Shaybaar deked shaqaynaysa amaahda ma aha shaybaar, qaabka guuldarraduna waa duufaan faafin ah oo ku dhacda shabakad shaqaynaysa. Ka hor intaadan bilaabin, maamulka u rar interface kale ama konsolka.

Hub tunnel address:    10.44.7.1/32
LTE tunnel address:    10.44.7.2/32
Lab ports:             ether7 on both routers, unused
Test hosts:            192.168.77.11/24 and 192.168.77.12/24

Qiyamyadaas waa tusaale ee ma aha shuruud. Waa inay ku yaallaan interface-yada tunnel-ka oo lagu maro waddada la ilaaliyey. Siyaasadda firewall-ka labada router waa inay u ogolaataa GRE inta u dhaxaysa labada ciwaan ee tunnel-ka, GRE-na waa borotokool IP 47, ma aha deked TCP ama UDP leh lambarka 47. Naqshaddan waligeed ma soo bandhigto GRE ceyriin ah WAN kasta.

Samee lammaanaha tunnel-ka oo leh ID iswaafaqsan

Labada daraf waa hal interface macquul ah oo laba jeer lagu qeexay, sidaas darteed goob kasta oo aqoonsi waa inay iswaafaqdaa. Hub-ka:

/interface eoip add name=eoip-lab local-address=10.44.7.1 remote-address=10.44.7.2 tunnel-id=37 mac-address=02:1A:2B:00:00:01

Router-ka LTE ciwaannadu way rogmadaan MAC-na way duwan tahay:

/interface eoip add name=eoip-lab local-address=10.44.7.2 remote-address=10.44.7.1 tunnel-id=37 mac-address=02:1A:2B:00:00:02

ID-ga tunnel-ku waa inuu iswaafaqaa labada daraf oo aanu ku dhicin lammaane kale oo hore loogu habeeyey router kasta. Ciwaannada MAC waa qiyam gudaha lagu maamulo oo waa inay gaar u ahaadaan domain-ka lakabka labaad ee aad ku biirto, sidaas darteed ha isticmaalin mar kale qiime tusaale shirkadeed. Magacyada interface-yadu waa maxalli router kasta oo waa inay iswaafaqaan kaliya skriptiyadaada.

Buug-gacmeedka EoIP ee hadda wuxuu diiwaangeliyaa goobaha barta dhammaadka iyo ID-ga tunnel-ka wuxuuna si cad u sheegaa in EoIP uu yahay Ethernet GRE dul saaran. Waxba kuma jiraan amarkaas oo wax sirta, sidaas darteed hubinta lakabka hoose ayaa hor timaadda.

Buundo kaliya dekedaha tijaabada

Buundadu waa waxa tunnel-ka u beddela qayb, isku-dhafkeeduna waa xadka amniga oo dhan. Hub-ka:

/interface bridge add name=br-eoiphub protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:01
/interface bridge port add bridge=br-eoiphub interface=ether7
/interface bridge port add bridge=br-eoiphub interface=eoip-lab

Router-ka LTE:

/interface bridge add name=br-eoiplte protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:02
/interface bridge port add bridge=br-eoiplte interface=ether7
/interface bridge port add bridge=br-eoiplte interface=eoip-lab

Amarradan waxay abuuraan buundooyin cusub oo mid kastaa ku daraan laba deked oo sax ah. Interface-ka EoIP waa xubinta lakabka labaad; tunnel-ka sirta ah wuxuu ahaanayaa gaadiid la maro oo waligiis waa in aan loo darin deked buundo. Ha darin deked wax-soo-saar, hana bilaabin server DHCP buundada shaybaarka.

Sii labada martigeliyaha tijaabada ciwaanno ku yaal subnet aan la isticmaalin oo aan lahayn server DHCP tartan ah, sida 192.168.77.11/24 iyo 192.168.77.12/24. Uma baahna irrid caadi ah si ay isu gaaraan subnet-kaas gudihiisa, ciwaan interface router-na looma baahna frame-yadu inay gudbaan.

Qorshee kharashka dheeriga ah ka hor intaadan ballaarin LAN

EoIP IPv4 dul saaran wuxuu ku darayaa madaxyada Ethernet, GRE iyo IP dibadda hareeraha xamuulka la qaado. Xaaladda aan calaamad lahayn MikroTik waxay diiwaangelisaa 42 byte, sidaas darteed lakab hoose oo leh 1400 byte MTU IP la isticmaali karo wuxuu uga taga 1358 byte frame-ka gudaha. Lambarkaas waa miisaaniyad ee ma aha qiime MSS caalami ah, oo kama qasbo martigeliyaha buundada inuu diro frame-yo yaryar.

Hubi xadka dhabta ah ee waddada, ka dibna ku tijaabi frame-ka ugu weyn ee qalabku runtii diro. Frame 1500 byte ah oo ay tahay in lagu kala qaybiyo waddada la ilaaliyey wuxuu u dhaqmaa si ka duwan kan soo gala, farqiguna wuxuu u muuqdaa istaagga barnaamijka ee ma aha guuldarrada xiriirka.

/interface eoip print detail where name=eoip-lab
/interface bridge host print where bridge=br-eoiphub
/ping 192.168.77.12 count=4 interface=br-eoiphub

RSTP waxay maamushaa wareegyo, ma aha waddooyin barbar socda oo aan loo baahnayn, sidaas darteed topology-da tijaabada ku hay mid fudud. Ballaarinta buundada waxay sidoo kale ballaarisaa habdhaqanka faafinta, multicast iyo DHCP ee xiriirka mobaylka, taraafikadaasuna waxay cunaa awood ha ku socdo frame faa'iido leh ama ha ahaan.

Qorshee isku-xirka wax-soo-saarka kaliya marka shaybaarku gaaro cabbirka frame-ka iyo habdhaqanka barnaamijka ee aad runtii u baahan tahay. Ka hor beddelkaas, ku heshii ciwaanaynta, xubinimada VLAN, awoodda DHCP, ka-hortagga wareegyada iyo sida qofku u gaaro router-yada marka xiriirka laftiisu xiran yahay. Ballaarinta Ethernet waxay isku xirtaa domain-yada guuldarrada iyo qalabka labadaba, sidaas darteed waxay mudan tahay daaqad isbeddel ee ma aha deked kale oo buundo shaqaynaysa.