Jidka caadiga ah ee IPv6 wuu lumay ka dib markii gudbinta lagu shiday Linux

Waxaan net.ipv6.conf.all.forwarding=1 dhigay albaab Debian ah si uu u gudbiyo macaamiisha VPN, iyo qiyaastii nus saac ka dib mishiinku ma lahayn wax jid IPv6 caadi ah. Router-ka sare shaqaynayay, deriska link-local wali jawaabayay, uplink-na wali haystay cinwaankiisa caalamiga ah. Waxa istaagay waxa uu ahaa diyaargarowga kernel-ka ee ah in uu sii wado aqbalaadda router advertisements-ka interface-kaas. Jidku ma lumin markii aan qoray sysctl-ka; wuxuu lumay markii waqtiga jidka caadiga ah ee RA-da laga bartay uu dhammaaday oo aan waxba cusboonaysiin.

Marka hore waxba uma muuqan sidii wax jaban. Gudbintu way shaqaynaysay, macaamiishu way soo gudbayeen inta jidkii hore uu ku jiray kaydka, oo guuldarradu waxay timid ka dib markii isbeddelkii sababay. Daahitaankaas ayaa sabab u ah in lagu eedeeyo dhinaca sare ama qaanuun firewall oo aan waligiis ku lug lahayn.

Akhri shaxda jidadka ka hor inta aadan taaban sysctl kasta

Ku bilow ip -6 route show default oo akhri sifooyinka, ma aha oo kaliya albaabka. Jidka caadiga ah ee RA-da laga bartay waxa uu leeyahay calaamad proto ra, waxa uu qaadaa mudnaan oo waxa uu muujinayaa tirinta expires. Jidka gacanta lagu daray midkoodna ma leh, oo farqigaas waxa uu kuu sheegayaa habka uu leeyahay jidka.

$ ip -6 route show default
default via fe80::1 dev eth0 proto ra metric 1024 expires 1432sec hoplimit 64 pref medium

Kadib eeg cinwaanka: ip -6 addr show dev eth0. Cinwaan caalami ah oo leh waqtiyo nololeed la doorbiday oo sax ah oo lagu cabbiray saacado ayaa ka badbaadi doona jid caadi ah oo waqtigiisa nololeed router-ka lagu cabbiro daqiiqado. Cinwaanku waa jiraa laakiin jidka caadiga ah ma jiro, taasi waa calaamadda dhibaatada ogeysiisyada. Haddii cinwaankuna maqan yahay, marka hore waa in la dabacsado xiriirka, macluumaadka prefix ama ogaanshaha cinwaannada labanlaaban.

Sababta gudbintu u damiso habaynta RA

RA waa baakad ICMPv6 nooca 134, oo laga soo diro isha link-local oo leh xad boodbood 255. Ka hor inta kernel-ku isticmaalin, waxa uu eegaa accept_ra interface-ka. Qiimaha caadiga ah waa 1, oo 1 macneheedu ma aha haa. Waxa ay ka dhigan tahay: aqbal kaliya inta host-kan aanu gudbinayn. Dhig forwarding=1 oo shardigaas wuu guuldarraystaa, sidaas darteed ogeysiiska waa la tuuraa ka hor inta aan la tixgelin wax prefix ama router caadi ah oo ku jira.

Waxa jira saddex qiime, oo kaliya tan saddexaad ayaa ka badbaadda gudbinta:

Laba calan oo kale ayaa go'aamiya waxa dhab ahaan la rakibo. accept_ra_defrtr waxa uu maamulaa haddii router-ka caadiga ah ee ogeysiiska uu noqdo jid, accept_ra_pinfo-na waxa uu maamulaa haddii macluumaadka prefix loo isticmaalo habaynta cinwaanka. Daminta accept_ra_defrtr waa habka caadiga ah ee lagu hayo cinwaannada SLAAC host gudbinaya iyada oo aan la baran jid caadi ah. Waa kabaal ka duwan accept_ra, waana kan la isticmaalo marka la rabo cinwaanno laakiin aan la rabin jid. Tixraaca kernel-ka ee IP sysctl waxa uu taxaa saddexda.

Ku xaqiiji saddex amar

Marka hore, akhri qiimayaasha nool halkii aad ka akhrin lahayd faylka aad u malaynayso in la rakibay:

sysctl net.ipv6.conf.eth0.forwarding net.ipv6.conf.all.forwarding \
       net.ipv6.conf.eth0.accept_ra net.ipv6.conf.eth0.accept_ra_defrtr

Marka labaad, caddee in ogeysiisyadu wali imanayaan. Shaandhaynta baabka nooca ICMPv6 waa ku filan tahay, oo waxa ay kaa badbaadinaysaa akhrinta darbi taraafikada ogaanshaha deriska:

tcpdump -ni eth0 'icmp6 and ip6[40] == 134'

Haddii waxba soo muuqan daqiiqado badan, accept_ra ma aha dhibaatadaada. Dhinaca sare waxa uu joojiyay ogeysiinta, wax jidka ku jira ayaa shaandheeya ICMPv6, ama interface-kaas dhab ahaan kuma jiro qaybta aad u malaynayso. Marka saddexaad, adigu codso ogeysiis oo akhri goobihiisa:

rdisc6 eth0

rdisc6 waxa uu ku jiraa baakadda ndisc6 ee Debian iyo Ubuntu. Soo-saarka, eeg waqtiga nololeed ee router-ka iyo mudnaanta ka hor inta aadan wax kale beddelin. Ogeysiis leh waqti nololeed router 0 waa amar lagu tirtirayo router-ka caadiga ah, oo ma jiro qiime accept_ra oo ka dhigaya jid la isticmaali karo. Sidaas oo kale waxa aad ku qabanaysaa CPE sare oo ku jira habka buundada oo qaybiya prefix-yo laakiin aan waligiis isu soo bandhigin router.

Ka dhig uplink-ka interface-ka kaliya ee oggolaanaya

Haddii dhinaca sare ay tahay inuu noqdo router-ka caadiga ah, halkaas ka aqbal ogeysiisyada in kasta oo gudbin jirto, meel kalena ha ka aqbalin:

# /etc/sysctl.d/60-ipv6-router.conf
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.eth0.accept_ra = 2
net.ipv6.conf.eth0.accept_ra_defrtr = 1

Xaddidku waa muhiim sababtoo ah gudbinta IPv6 ee Linux waa hal furaha caalami ah, ma aha mid kasta oo xiriir ah. Qor 1 gudaha net.ipv6.conf.wg0.forwarding kadibna akhri net.ipv6.conf.all.forwarding: qiimaha caalamiga ah wuu rogmadaa oo interface kastaa waxa uu bilaabaa gudbin. Ma noqon kartid router tunnel-ka dhexdiisa iyo host caadi ah LAN-ka. Waxa aad xaddidi kartaa waa aqbalaadda. Hay accept_ra=2 uplink-ka oo ka tag interface-yada tunnel-ka iyo LAN-ka 1 ama 0, si ogeysiis lumay oo tunnel-ka soo galay uusan u rakibi karin jid caadi ah oo u jeeda.

sysctl -w ku meel gaar ah ma badbaadayaan kulanka xiga, oo labadaba systemd-networkd iyo NetworkManager waxa ay qoraan qiimayaashan ka timid konfigurashadooda. networkd, dhig IPv6Forwarding=yes iyo IPv6AcceptRA=yes faylka .network ee uplink-ka; networkd waxa uu IPv6Forwarding ku qeexayaa mid caalami ah sababta kernel-ka oo kale. NetworkManager, ipv6.method=auto uplink-ka ayaa wada qiimaha accept_ra, sidaas darteed mar kale akhri sysctl-ka ka dib nmcli connection up halkii aad ka aamin lahayd hubinta ugu horreysa.

Beddelka aan isbeddelin, ip -6 route add default via fe80::1 dev eth0, dhab ahaan wuu shaqeeyaa, waana jawaab macquul ah marka router-ka sare uu leeyahay cinwaan link-local deggan. Si cad u ogaaw waxa aad ka tanaasulayso. Jid caadi ah oo aan isbeddelin waligiis lama cusboonaysiiyo lamana laalo, sidaas darteed waxa uu sii tilmaamayaa deris dhintay ka dib marka dhinaca sare la beddelo. Jidka RA si ammaan ah ayuu u guuldarraystaa; kan aan isbeddelin si aamusan ayuu u guuldarraystaa.

Tijaabi baakad la gudbiyay, ma aha tan albaabka laftiisa

Ping-ga albaabka laftiisa waxa uu ku guulaysan karaa jid aan macmiilna isticmaali karin, waxa uuna ku guulaysan karaa sababtoo ah albaabku waa isha. Ka tijaabi macmiil ku xiran, kadibna weydii albaabka waxa uu sameyn lahaa cinwaanka macmiilkaas:

# on the VPN client
ping -6 -c 3 2001:4860:4860::8888

# on the gateway, using a client address
ip -6 route get 2001:4860:4860::8888 from fd42:20::2

Kadib sug hal waqti nololeed router oo mar kale eeg. Xaaladda deggan ee aad rabto waa jid caadi ah oo calaamad proto ra leh oo qiimaha expires mar walba dib u dejiyo, iyo all.forwarding=1. Haddii expires kaliya hoos u tirinayo, ogeysiisyada wali meel ayaa lagu tuurayaa, oo kan badanaa lagu eedeeyo waa maareeyaha shabakadda oo dib u qora accept_ra ka dib markii sysctl-ka waqtiga kicinta uu horey u socday.

Ka hor inta aadan tan xirmin, xaqiiji afar wax: jidka caadiga ah waa proto ra oo wuu cusboonaysiinayaa, accept_ra=2 waxa uu khusayaa kaliya uplink-ka, gudbintu wali 1 waa ka dib dib u kicid iyo ka dib dib u kicidda maareeyaha, oo macmiil, ma aha albaabka, ayaa dhammeeya ping IPv6. Haddii macmiilku wali ku guuldarraysto jid caafimaad qaba, tuhmaha xiga waa jidka soo noqodka ama firewall sare, ma aha ogeysiiska.