Delegashiinka Prefix IPv6 ee VPN-ka Goob-ilaa-Goob: Liiska Hubinta

Tunelka kicinta waa qaybta fudud. Waxaan arkay isku-xir goob-ilaa-goob oo maalmo u taagnaa, halka qof kasta oo ku nool LAN-ka fog uu helayay aamusnaan oo keliya, sababtoo ah prefix-ka la delegateeyay ee ka dambeeya gateway-kaas waxaa lagu habeeyay interface laakiin waligii lama marin tunelka. Cinwaannada tunelka waxay ka jawaabi jireen ping-ka wakhtigaas oo dhan, taasina waa sababta qofna uusan u fiirin prefix-ka. Waa tan taxanaha aan hubiyo marka prefix IPv6 la delegateeyay ay tahay inuu ka gudbo VPN-ka goobta: khariidadda prefix-ka, xulayaasha taraafikada, gudbinta iyo firewall-ka, ka dibna waddada soo noqodka.

Qor khariidadda prefix-ka ka hor inta aadan taaban tunelka

Delegashinka prefix-ku wuxuu block siiyaa router-ka codsaday. Ma rakibo waddo peer-ka, ma kordhiyo block-kaas on-link, mana u sheego gateway-ka fog waxa ka dambeeya router-ka codsaday. Saddexdan adigaa habaynaya, waxayna ka tirsan yihiin qorshaha cinwaannada ka hor inta aan faylka konfig ah beddelmin.

Goob kasta, qor prefix-ka la delegateeyay, /64-ka dhab ahaan loo isticmaalo LAN-ka, cinwaannada tunelka iyo mulkiilaha waddo kasta. Bixiyaha wuxuu goobta A u delegateeyaa 2001:db8:a1::/56, oo ku adeegta LAN-keeda 2001:db8:a1:10::/64; goobta B waxay haysataa 2001:db8:b2::/64. Haddii goobta A ay adeegto kaliya /64-kaas, labada daraf waa inay sheegaan 2001:db8:a1:10::/64 halkii ay ka ahaan lahaayeen /56-ka oo dhan.

Ku dhawaad mar walba waxaa soo baxa laba khalad. Mid waa in prefix-ka fog loo arko on-link, la buundo, ama la saaro interface-ka tunelka si gateway-ku uga jawaabo codsiga deriska ee martigaliyayaasha uusan gaari karin. Midda kale waa in la shaaciyo /56-ka oo dhan marka kaliya hal /64 la habeeyay: shaxda waddooyinku waxay sheegtaa in block-ku gaari karo, cinwaannada badankoodna waxay ku dhacaan god madow.

Isku waafaji xulayaasha taraafikada labada daraf iyo waddooyinka

IKEv2 iyo WireGuard labaduba waxay diidaan taraafikada aan is waafaqsan, si aamusnaan ku filan oo tunelku wali u muuqdo mid caafimaad qaba.

strongSwan gudihiisa xulayaashu cad yihiin. Goobta A:

conn a-to-b
    left=2001:db8:ff::1
    leftsubnet=2001:db8:a1:10::/64
    right=2001:db8:ff::2
    rightsubnet=2001:db8:b2::/64
    auto=start

conn-ka goobta B wuxuu matalaa labada subnet. Marka aysan is waafaqsanayn, jawaab-bixiyuhu wuxuu diidaa CHILD_SA isagoo isticmaalaya TS_UNACCEPTABLE, sidaas darteed child SA waligiis ma kaco inkastoo IKE_SA kacay. Labada dhinac subnet-ka la habeeyay waa inuu la mid noqdaa waxa kernel-ka maxalliga ah u mariyo tunelka.

WireGuard wuxuu isla macluumaadka ku qaadaa AllowedIPs, iyadoo leh hal qallooc: AllowedIPs waa shaandhada isha marka la helayo iyo waddo marka la dirayo. Haddii gelitaanka peer-ka goobta B ee goobta A uu ka tago 2001:db8:a1:10::/64, baakadaha ka imanaya goobta A waxay ku yimaadaan handshake ansax ah oo waxaa loo tuuraa sidii aan la fasaxin. Taas waxay abuurtaa qaabka caanka ah ee handshake-ka had iyo jeer cusboonaysiiya inta jawaab waligeed bixin. Isbarbar dhig labada daraf wg show wg0 allowed-ips. Mar walba dib u eeg liiskaas marka delegashinku is beddelo; /64 duugoobay wuxuu fadhiyada nool dhigaa oo prefix-ka cusub gaari karin.

Marka hore ka reeb gudbinta, firewall-ka iyo MTU

Ka hor inta aadan akhrin sadarka log ee xiga, xaqiiji in gateway-yadu gudbiyaan tobankii. sysctl net.ipv6.conf.all.forwarding waa inuu ku soo celiyaa 1 labadaba, oo lagu dabaqay interfaces-ka tunelka iyo LAN-ka. Hal dabin ayaa la socota: marka gudbintu shidan tahay, interface leh accept_ra=1 wuxuu joojiyaa aqbalaadda xayeysiisyada router-ka ee bixiyaha, sidaas darteed qalabku wuxuu lumin karaa waddada caadiga ah ee kore inkastoo tunelka gudihiisa si qumman u mariyo. Deji accept_ra=2 meesha RA-bixiyaha weli loo baahan yahay.

Kadib xeerarka firewall-ku waa inay fasaxaan prefix-ka labada jiho, ICMPv6-na waa inuu noolaadaa: ogaanshaha deriska, packet-too-big iyo destination-unreachable ma aha ikhtiyaari. Haddii aad tuurto, ogaanshaha MTU-da waddadu way jabtaa, waxaana helaysaa xiriiryo furma oo markaas ku hakada jawaabta weyn ee ugu horreysa. Laba xeer oo ugu yaraan waxay u eg yihiin sidan:

nft add rule inet filter forward ip6 saddr 2001:db8:a1:10::/64 ip6 daddr 2001:db8:b2::/64 accept
nft add rule inet filter forward ip6 saddr 2001:db8:b2::/64 ip6 daddr 2001:db8:a1:10::/64 accept
nft add rule inet filter forward icmpv6 type { packet-too-big, nd-neighbor-solicit, nd-neighbor-advert } accept

MTU waxay ka dambeysaa tan. Tunelku wuxuu hoos u dhigaa MTU-da la isticmaali karo oo ka hooseeya 1500, IPv6-na waxay dalbataa in xiriir kastaa uu qaado ugu yaraan 1280. Ping-yada yaryar way gudbaan, fadhiga SSH wuu qallalaa marka ay timaado duufaan weyn, /proc/net/snmp6-na wuxuu muujinayaa farriimaha packet-too-big ee waligood soo noqon. Si cad u deji MTU-da tunelka, ama ku xaddid TCP MSS shaxda mangle, oo u ogolow ICMPv6 ee sheegaya MTU yar inuu soo noqdo.

Tijaabi waddada soo noqodka, ma aha cinwaanka tunelka

Cilladda ugu waqti badan qaadata waa mariinta hal-jiho. Gateway kastaa wuxuu prefix-ka fog u mariyaa tunelka, laakiin martigaliyayaashu waxay ku jawaabaan gateway-kooda caadiga ah sababtoo ah halkaas ayaa /64-koodu ku yaal. Baakad gaarsiinta meesha loo socdo waa kala bar waddada.

Laba amarro ayaa xalliya inta badan. Goobta A ip -6 route get 2001:db8:b2::53 from 2001:db8:a1:10::5 wuxuu muujinayaa interface-ka jawaabta ishaas ay isticmaali lahayd; samee hubinta muraayadda goobta B. Kadib taraafik ka abuur martigaliye halkii gateway, oo isbarbar dhig tiriyaasha labada daraf.

Haddii codsiga deriska ee prefix-ka fog uu ka muuqdo tunelka, prefix-kaas wuxuu on-link ku yahay meel aanay ahayn inuu ahaado; hagaaji taas ka hor inta aadan hagaajin waddooyinka. Proxy NDP waxay daboolaa kiisaska ay buundada dhab ahaan loo baahan yahay, ma aha beddelka waddo.

Qorshee in prefix-ku kaa hoos is beddelo

Delegashinka prefix-ku waa heshiis kiro oo u dhexeeya router-ka delegateeya iyo kan codsada, cusboonaysiintuna waxay soo celin kartaa block kale: /56 kale ka dib guuritaanka bixiyaha, ama kiro ka gaaban inta tunelku taagnaa. Meel kasta oo sheegta prefix-ka hore waa duugoobaysaa isku mar: waddooyinka, xulayaasha, AllowedIPs, xeerarka firewall-ka, diiwaannada DNS iyo ilaalin kasta oo hardcode-gareeya cinwaanno sugan. Qulqulka fariimaha wuxuu ku yaal RFC 8415.

Meesha la filayo in prefix-ku dhaqaaqo, hay qorshe cinwaanneed gudaha ah oo aan isaga ku tiirsanayn oo ku turjun xadka. NPTv6 waa ikhtiyaarka bilaa-xaalada ah wuxuuna sii hayaa siyaasadda gudaha oo la akhriyi karo, laakiin waa turjumaad prefix, ma aha lakab sixir ah: xadka /64 waa inuu is waafaqaa, checksum-yada waa la hagaajiyaa, codsiyada ku dhex daray cinwaanno suganna wali way jabaan. Haddii aad hayso cinwaannada bixiyaha min daraf ilaa daraf, qor habdhaqanka kirada iyo nidaamka isbeddelka qorshaha cinwaannada.

Ku dhammee tijaabo waqti-gaadhiste: martigaliye la fasaxay oo ku yaal LAN kastaa wuxuu gaaraa adeeg ku yaal LAN-ka kale, jawaabtu waxay ku soo noqotaa tunelka, isla lammaanahaasna way shaqeeyaan ka dib dib-u-kicin tunelka iyo cusboonaysiin delegashin. Haddii qaybta ugu dambaysa fashilanto, naqshaddu waxay ku tiirsan tahay xaalad aan toddobaadka ka badbaadayn.