IPv6 link-local kama shaqeeyo VPN: sababta fe80 ugu joogsato xiriirka
Cinwaanka fe80:: waxa uu macne leeyahay hal xiriir oo keliya. Eeg sababta VPN la maro uusan u qaadi karin, sida guuldarradu u muuqato, iyo cinwaanka aad isticmaasho beddelkiisa.
Waxaad kor u qaaddaa tunnel-ka, waxaad ping ku sameysaa fe80::1 adigoo tunnel-ka u isticmaalaya interface-ka laga soo diro, waxna dib uma soo noqdaan. Tani ma aha qaanuun firewall ah oo aad illowday. Cinwaanka link-local waxa uu macne leeyahay oo kaliya xiriirka keliya ee uu ku sameysmay, VPN-na la maro ma aha xiriirkaas. fe80::1 ee router-ka fog waxa uu ku nool yahay qaybta LAN fog; waxaad ku sugan tahay hal bood oo ka fog qayb kale, IPv6-na ma laha hab uu router-ku u gudbiyo baakadaha link-local haba yaraatee.
Horgalaha fe80 waxa uu qeexayaa baaxad, ma aha kala duwanaansho
Link-local unicast waa fe80::/10, sifooyinka qeexaya ma aha lambarka laakiin baaxadda. Cinwaanku waxa uu ansax yahay oo kaliya hal xiriir, interface kastana waxa uu ka sameystaa mid ka mid ah aqoonsigiisa, taas oo sababta in laba mishiin oo aan xiriir la lahayn oo ku sugan laba shabakadood oo aan xiriir la lahayn ay labaduba ka jawaabi karaan fe80::1 iyagoo aan wax isku dhac ah la kulmin. Horgalahu wuxuu asal ahaan leeyahay “xiriirka qaar”; xiriirka laftiisu waxa uu ka yimaaddaa macnaha guud.
Host-ka, macnahaas guud waa aagga, ama scope ID, oo aad ku darto calaamadda boqolkiiba: fe80::1%eth0 Linux, fe80::1%3 ama fe80::1%12 Windows iyo qalabka muujiya tusmada interface-ka. Kernel-ku waxa uu cinwaanka ku xalliyaa tusmada interface-ka kadibna wuu diraa. Haddii aad ka tagto aagga, meesha loo socdo way madmadow noqotaa, sidaas darteed stack-ku ma laha hab uu qayb u doorto.
Sababta tunnel la maro uusan u gaarsiin karin
VPN la maro waa interface dhibic-ilaa-dhibic oo qaada cinwaannadiisa, badanaa /64 oo ah meel IPv6 unique-local ama gaar ah oo tunnel-ka gudihiisa ah. LAN-ka fog waa xiriir gooni ah, oo laga gaaro dhammaadka tunnel-ka isagoo kuu maraya oo kuu gudbinaya. Kuwani waa laba qaybood oo kala duwan, sidaas darteed cinwaan ka yimid mid ma aha meel ansax ah oo ku taal tan kale.
Qaanuunka gudbintu waa mid cad oo ku qoran heerka, ma aha wax yaab leh oo client-kaaga ah: router-yadu ma gudbiyaan baakado leh isha ama meesha loo socdo link-local. Taas ayaa sababta baakaddu u dhimato xitaa marka shaxda marinka ay u muuqato mid sax ah. Ku dar marrin fe80::/64 oo u jeeda tunnel-ka, stack u hoggaansama heerka ayaa diidayaa ama aqbalaa oo tuurayaa baakad kasta oo u dhigma: baaxadda meesha loo socdo waxay tidhaahdaa “xiriirkan oo kaliya”, interface-ka baxana ma aha xiriirkaas.
Ogaanshaha deriska waxa uu xoojiyaa isla xadkaas. Host-yadu waxay xalliyaan link-local boodka xiga iyagoo isticmaalaya codsi deris oo loo diro multicast baaxadda xiriirka leh iyo xaddiga bood oo 255 ah, sidaas darteed router-yadu way diidi karaan wax kasta oo la gudbiyo. Tan ka shaqaysiinta tunnel-ka waxay ka dhigan tahay in ogaanshaha loo sameeyo qayb fog, taas oo ah buundada Layer 2 oo koofiyad kale qaba.
Waxa jira guuldarro labaad oo aamusnaan badan, oo qabata dadka isku dayaya inay si kasta ku qasbaan marinka: aagga. Aag kasta oo aad gudaha ku qorto waxa uu magacaabaa interface-ka tunnel-ka, halka cinwaanka aad rabto uu ku xidhan yahay interface-ka LAN fog. Labaduba waligood isma waafaqaan, sidaas darteed baakadda lama hanuunin karo interface-ka saxda ah ee dhinaca fog.
Sida guuldarradu u muuqato ficil ahaan
Soosaarka qalabka ee khalad baaxadeed waxa loo akhriyaa sida khalad marrin ama firewall, taas ayaa sababta dadku ugu qaataan galab khaldan lakabka khaldan.
| What you run | What you see | What it means |
|---|---|---|
| ping fe80::1 with no zone | Invalid argument on Linux, or a transmit failure on Windows | The stack cannot pick an interface for an ambiguous destination |
| ping -6 -I tun0 fe80::1 | Destination unreachable, or a silent timeout | The address is not on the tunnel link, so there is nothing on-link to answer |
| ssh user@fe80::1 after the tunnel is up | Hangs, then no route to host | The SYN never left the machine in a deliverable form; the server logs nothing |
| ip -6 neigh show dev tun0 | Empty table | No neighbor entry can exist for a link-local host that is not on this link |
| fe80::/64 inside AllowedIPs or route-ipv6 | Config accepted, traffic still dropped | The tunnel carried the packet; the receiving stack refused to forward it |
Sadarka saddexaad ayaa lumiya waqtiga ugu badan, sababtoo ah client ssh oo aan soosaar lahayn waxa uu u muuqdaa dhibaato adeeg dhageysanaya. Haddii aad haysato hab aad ku gasho, hubi dhinaca fog oo xaqiiji in sshd ku xidhan yahay dhammaan cinwaannada ama mid kaliya.
Isticmaal cinwaan loogu talagalay in la maro
Wax kasta oo aad uga gaarto tunnel-ka, isticmaal cinwaanka adeegga loo siiyay ujeeddadaas: cinwaan unicast caalami ah, ama cinwaan unique-local ah oo ka yimid fc00::/7, baaxadda loo qoondeeyay si sax ah kiiskan gudaha. Xaqiiji in dhageystuhu runtii xidho, oo hubi waddada soo noqoshada iyo qaanuun kasta oo firewall ah oo host-ka.
Fiiri host-ka fog halkii aad qiyaasi lahayd. ip -6 addr show waxa uu taxaa cinwaannada jira, ss -6 -ltn-na waxa uu taxaa waxa daemon-ku dhageysanayo. Adeeg ku xidhan oo kaliya fe80:: waxa laga gaari karaa oo kaliya qaybtiisa, taas oo badanaa tahay caadi aan qofna si ula kac ah u dooran oo lagu beddeli karo oggolaanshaha maamulaha.
Marka adeegga runtii aan dib loo xidhi karin, buundada kor u qaad lakabka codsiga halkii lakabka shabakadda. Relay ku yaal host-ka fog oo dhageysanaya cinwaan la mari karo oo ku xidhma link-local waxa uu xalliyaa dhibaatada isagoo aan qaybna fidin:
socat TCP6-LISTEN:8080,bind=[fd00:1:2::10] TCP6:[fe80::1%eth0]:80Halkan aaggu waxa uu ku yaal dhinaca saxda ah, host-ka runtii leh eth0 xiriirkaas. Client-kaagu waxa uu la hadlayaa fd00:1:2::10, oo si caadi ah loo maro, relay-na waxa uu boodka link-local ku sameeyaa gudaha. Isla xeeladdaas waxay ka shaqaysaa UI web ee qalab ama BMC duq ah oo kaliya ku dhawaaqa cinwaan link-local.
Marka buundadu runtii tahay jawaabta, iyo waxa la hubiyo
Qaar ka mid ah rakibaaddu runtii waxay u baahan yihiin hal qayb la wadaago: qalab ku hadla ogaanshaha link-local oo kaliya, qalab ku tiirsan multicast, shaybaadh soo saarta LAN fidsan. Taasi waa dhibaato Layer 2 waxayna u baahan tahay jawaab Layer 2, sida qalab tap oo buundo ku ah interface-ka fog ama badeecad client leh hab buundo cad. Waxay kuu kacdaa taraafikada broadcast iyo multicast ee gudba tunnel-ka iyo ogaanshaha deriska oo ay tahay inuu ka shaqeeyo daraf ilaa daraf.
Ha u soo dhowaan tan adigoo ku daraya fe80::/64 profile la maro. Taasi waxay abuurtaa xaaladda ugu xun: habayntu waxay u muuqataa mid dhammaatay, shaxda marrinku waxay muujinaysaa gelitaan, baakad kastana weli meel uun ayaa lagu tuuraa inta u dhaxaysa laba stack oo labaduba si sax ah u dhaqmayaa.
Ku xaqiiji interface-ka halkii ping. ip -6 addr show tun0 waxa uu sheegaa in xiriirka tunnel-ku sameystay cinwaan link-local u gaar ah, ip -6 route get fe80::1%tun0-na waxa uu sheegaa waxa kernel-ku runtii ku sameyn lahaa meel baaxad leh. Marka kernel-ku sheegto in meesha loo socdo aan laga gaari karin interface-kaas, wax dejinta tunnel ah ma beddelayo taas, waana waqtigii aad joojiso tafatirka profile-ka.
Taxane gaaban oo xalliya su'aasha:
- Akhri cinwaanka host-ka fog oo ogow inuu yahay fe80:: ama horgale la mari karo.
- Haddii uu yahay fe80::, dib u xidh adeegga, relay ku samee host-kaas, ama buundo qaybta; haddii uu la mari karo, hagaaji marinka, firewall-ka ama cinwaanka xidhitaanka.
- Mar kasta oo aad dib u tijaabiso, dib u hubi aagga, sababtoo ah amarka la koobiyeeyay badanaa waxa uu hayaa interface-ka qaldan.