Ka bixista IPv6 way dhintaa ka dib dib-u-bilow OpenVPN: hubi lahaanshaha prefix-ka
IPv6 way dhintaa ka dib marka tunnel-ka dib loo abuuro. Go'aanso yaa leh prefix-ka la wakiilay, cinwaannada macaamiisha iyo dariiqa soo-noqodka ka hor inta aanad wax dib u bilaabin.
IPv6 waxay joojisaa marinta taraafikada isla marka OpenVPN dib loo bilaabo, IPv4-na way sii shaqaysaa. Interface-ka tunnel-ka dib ayaa loo abuuray, wax kale oo maareynayay xaaladdiisa IPv6 ayaa lumiyay cinwaanka ama dariiqa prefix-ka gaarsiin kara. Saddex qaybood oo xaalad ah oo kala duwan ayaa ku lug leh, mid kastaa wuxuu leeyahay milkiile kale: prefix-ka la wakiilay ee bixiyaha iyo cimrigiisa, cinwaannada la siiyo macaamiisha VPN, iyo dariiqa sare ee prefix-ka macmiilkaas ku celiya server-ka. Aqoonso milkiilaha qayb kasta ka hor inta aanad taaban daemon kasta, sababtoo ah dib-u-bilowga khaladka ah wuxuu dhibaatada qarinayaa hal maalin oo wuxuu ku soo celinayaa isku-xirka xiga.
Saddex qaybood oo xaaladda IPv6, saddex milkiile
| State | Typical owner | What breaks when it is wrong |
|---|---|---|
| Delegated prefix and lifetime | Upstream router or provider via DHCPv6-PD | Clients keep addresses that the upstream no longer routes |
| Client addresses inside the tunnel | OpenVPN server config or a delegation daemon | No global address, or an address outside the routed prefix |
| Return route for the client prefix | Upstream router, or the server's own routing table | Outbound works, replies never arrive |
Cinwaan leh baaxad caalami ah oo tunnel-ka dhexdiisa ah keligiis kuma filna. Router-yada sare wali waa inay prefix-kaas ku celiyaan server-ka VPN, mana samayn doonaan sababtoo ah server-ku si shil ah ayuu cinwaan ka helay.
Taasina waa sababta koobiyeysiga /64 dadweyne ee barkada tunnel-ku khatar u tahay. Prefix lagu jiheeyay server-ka ma aha mid la mid ah prefix-ka dhinaca sare u arko on-link, oo helitaanka deriska ma buuxin doono farqigaas.
Akhri xaaladda server-ka ka hor inta aanad wax beddelin
Qabo xaaladda laba jeer, hal mar inta IPv6 shaqaynayso iyo hal mar ka dib dib-u-bilowga, ka dibna isbarbar dhig. Muuqaallada akhriska-kaliya way ku filan yihiin, oo wax kuma kacaan inta lagu jiro daaqadda dayactirka:
ip -6 addr show
ip -6 route show table all
ip -6 rule show
sysctl net.ipv6.conf.all.forwardingRaadi saddex farqiin oo gaar ah: dariiq lumay, cinwaan u guuray cimri duugoobay ama aan sax ahayn, iyo prefix isbeddelay ka dib wakiilid kale inta aragtida VPN ay wali ku dhawaaqayso tii hore.
Haddii cinwaanku lumay laakiin prefix-ku aanu isbeddelin, daemon-ka qoondeeya ayaa joojiyay maareynta interface-ka. Haddii prefix-ku isbeddelay laakiin cinwaannadu aanay isbeddelin, qaabeynta macmiilka waa duug. Labada cilladood waxay browser-ka ka muuqdaan isku mid oo wax qayb ah ma leh.
Go'aanso haddii dhcpcd ay tahay inuu maareeyo tunnel-ka
dhcpcd waxay ogaan kartaa interface-yada oo waxay u wakiili kartaa qaybo prefix DHCPv6 ah interface-yada hoose, qaabeyntiisana waxay si cad u magacaabi kartaa bartilmaameedyada wakiilidda. Iyada oo aan lahayn bartilmaameed cad, dhaqankiisa la diiwaangeliyay wuxuu ku lug yeelan karaa interface-yo kale, sidaasna tunnel-ku wuxuu helaa cinwaan aan qofna qorshayn.
Laba shuruudood ayaa kugu riixi lahaa inaad u dhaafto cinwaanaynta taagan ee tunnel-ka OpenVPN: server-ku wuxuu ku riixaa cinwaanno go'an qaabeyntiisa, magaca tunnel-kana wuu isbeddelaa marka dib loo xirmaayo. Haddii labaduba run yihiin, si ula kac ah tunnel-ka ka reeb daemon-ka wakiilidda, iyada oo la socoto faallo sheegaysa sababta.
Haddii taa beddelkeeda wakiilidda tunnel-ku ula kac tahay, hirgelinta maaraynta isbeddelka prefix-ka. Taasi waxay ka dhigan tahay in la falceliyo marka prefix-ka la wakiilay ama cimrigiisu isbeddelo, la cusboonaysiiyo prefix-ka macmiilka ee server-ku ku dhawaaqo, oo dariiqa dib loo daro. Ka reebista interface-ka naqshaddaas waxay meesha ka saaraysaa qaybta kaliya ee garanaysa prefix-ka cusub.
Dib-u-bilowga dhcpcd waxaa laga yaabaa inuu u muuqdo mid wax hagaajinaya sababtoo ah waxay dib u abuurtaa xaalad, laakiin waxay sidoo kale cusboonaysiisaa ama ka noqonaysaa qaabeynta interface-yo aadan ka fikirin. Soo-kabkaas kama dhigayo shuruud ka dib dib-u-bilow kasta oo VPN ah. Waxay sidoo kale dib u dejisaa tirooyinka aad u isticmaalayso caddayn. Dooro dib-u-roris bartilmaameed ah oo ku saabsan interface-ka aad dhab ahaan beddeshay.
Xaqiiji IPv6 si gooni ah uga duwan NAT-ka IPv4
Xaqiiji in gudbinta ay firfircoon tahay iyo in dariiqa sare uu tilmaamayo prefix-ka dhabta ah ee macmiilka, ka dibna samee xiriir IPv6 cusub oo la ogolaaday. Sidoo kale hubi shaxda dariiqyada IPv6 ee macmiilka laftiisa, sababtoo ah macmiil muujinaya cinwaan dadweyne ma caddeeyo in codsigiisu uu isticmaalay tunnel-ka.
Qarinta IPv4 waxay xallinaysaa dhibaato kale: dariiqa soo-noqodka ee ilo gaar ah. Waxba kama qabato prefix IPv6 la laabtay, oo ku daristiisu ma soo celinayso IPv6.
Ku soo gabagabee diiwaanka lahaanshaha: qaybtee wakiiltaa prefix-ka, qaybtee qoondeysaa cinwaannada macaamiisha, qaybtee haysata dariiqa soo-noqodka, iyo waxa ku dhaca mid kasta marka dib loo xirmo. Afar sadar oo runbook ah waxay kayd u tahay qofka xiga inuu dib u bilaabo saddex daemon si uu u helo tii muhiimka ahayd.