Laba bood VPN oo hal Pi ah: waddo kee ayaa qaada lammaanaha kee
Laba cinwaan tunnel oo hal Pi ah ma aha cillad. Meel kasta oo loo socdo waxay u baahan tahay qaadeheeda, caddaynteeda iyo qorshe kayd ah oo la sheegay marka boodka dibadda uu dhinto.
Laba cinwaan tunnel oo ku yaal loox yar waxay u muuqdaan khalad, falcelintuna waa in mid la tirtiro. Falcelintaas waxay jebisaa waxa ay ahayd in la nadiifiyo. Martigeliyaha qaada laba bood wuxuu hayaa hal cinwaan xiriir kasta, cinwaan kastana waddo kale ayaa doorataa. Su'aasha mudan in la weydiiyo waa waddo kee ayaa doorata qaade kee meel loo socdo kee, ma aha inta cinwaan ee jira.
Saddex meelood oo u baahan qaadeyaal kala duwan
Silsilad laba bood ah waa saddex fasalka oo meelaha loo socdo oo is dul saaran, mid kastana xiriir kale ayaa qaada. Lammaanaha dibadda waa in lagu gaaro xiriirka jireed. Lammaanaha gudaha waa in lagu gaaro tunnelka dibadda. Meesha loo socdo ee barnaamijka la daboolay waa in lagu gaaro tunnelka gudaha, oo gaadiidkiisa uu qaado kan dibadda.
| Destination class | View that names the carrier | Command that proves it | Symptom when the wrong carrier wins |
|---|---|---|---|
| Outer peer, 198.51.100.10 | the main table, by destination | ip route get 198.51.100.10 | the outer handshake never completes |
| Inner peer, 203.0.113.7 | the main table once the outer tunnel is up | ip route get 203.0.113.7 | the inner handshake leaves over the physical link |
| Application destination, 172.30.9.1 | the table the inner client's traffic is selected into | ip route get 172.30.9.1 from 10.8.0.2 | the exit address looks right and the traffic never crossed the outer hop |
| Parallel tunnels, one per source group | one policy per group, not the main table | ip rule show beside a marked test connection | both tunnels are up and one steals the other's traffic |
Ka buuxi safafka cinwaannada dhabta ah ee akhristaha ka hor inta aanad taaban waddo, maxaa yeelay shaxdu waxay faa'iido leedahay oo kaliya marka ay tahay mid cad. Silsilad shaqaysa waxay buuxisaa afarta saf isku mar, silsilad badh shaqaysana waxay badanaa buuxisaa mid ka mid ah qaade khaldan. Akhrinta safka khaldan sida cilladda ayaa u beddela dhibaatada waddooyinka galab dhan oo wax ka beddel ah.
Cinwaannadu waxay leeyihiin doorar, ma aha tiro
Linux wuxuu ogolaadaa dhowr cinwaan oo interface keliya ah iyo dhowr tunnel oo hal martigeliye ah, sidaas darteed tiro waxba kama sheegto saxnaanta. Waxa muhiimka ah waa cinwaan kee xiriir kee, iyo in waddada lammaane gaar ah ay doorato xiriirka aad ula jeeday. Saddex aragtiyood ayaa taas ka jawaabaya saddex jiho, waana mudan in mar kasta isla nidaamkaas loo akhriyo.
Liiska cinwaannada wuxuu muujinayaa waxa jira iyo xiriirka kee ayaa iska leh. Shaxda waddooyinka waxay ka jawaabtaa su'aasha qaadaha ee gaadiidka caadiga ah ee meelaha loo socdo. Aragtida siyaasadda ayaa mar kale ka jawaabta gaadiidka lagu doortay isha ama calaamadda, taas oo ah habka caadiga ah marka laba macmiil ay wadaagaan hal martigeliye.
ip -4 addr show
ip -4 route show table all
ip rule showTirtiridda cinwaan sababtoo ah liisku wuxuu u muuqdaa mid dheer waxay ka saari kartaa qayb ka mid ah waddada, tirtiridda waddo sababtoo ah waxay u muuqataa mid dheeraad ah ayaa isla waxaas sameysa si aamusnaan badan. Midkoodna ma soo saaro khalad; lammaanuhu wuu joojiyaa ka jawaabista waddada aad ula jeeday isagoo weli laga gaari karo waddo kale. Barnaamij soo sheega cinwaanka bixitaanka lammaanaha gudaha ma caddeeyo in gaadiidku dhex maray tunnelka dibadda, maadaama marin toos ah uu isla indho-indhaynta bixiyo. Farqigaas u dhexeeya indho-indhaynta iyo caddaynta ayaa ah sababta qaadaha loogu hubiyo lakabka waddooyinka.
Nidaamka kicinta ayaa ka adkaada sugitaan go'an
Haddii macmiilka gudaha uu ku tiirsan yahay cinwaan ama waddo uu bixiyo macmiilka dibadda, kicinta waa in ay sugto kheyraadkaas halkii ay sugi lahayd dib u dhac. Hurdadu waxay shaqeysaa ilaa maalinta tunnelka dibadda uu gaabnaado, ka dibna si xilli-xilli ah ayuu u guuldareystaa si aan cidna u soo celin karin. Nidaamka ku saleysan tiirnaanta ayaa meesha ka saaraya mala-awaalka oo waxba kama bixiyo marka laga reebo sharraxaadda tiirnaanta hal mar. Magacyada interface-ka sidoo kale ma aha hab nidaam.
Kernel-ku wuxuu bixiyaa magacyo sida tun0 iyo tun1 sida ay u kala horreeyaan abuurista, nidaamkaasna wuu is beddeli karaa inta u dhexeeya dib u bilaabista ama dib u xiriirka. Ku xir habaynta aqoonsiga ay qalabku bixiso, ama magac aad si ula kac ah u qoondeysay. Magaca aad dooratay waa heshiis; magaca kernel-ku dooratay waa shil.
Ka hay gaadiidka macmiil kasta meel ka baxsan waddada barnaamijka kan kale, oo noqo mid sax ah waxa ikhtiyaarrada waddooyinka OpenVPN 2.6 run ahaantii ballan qaadaan. Habka caadiga ah ee dib u jiheynta ee la diiwaangeliyay wuxuu macmiilka ka dhigaa mid awood u leh inuu gaaro lammaanihiisa fog isaga oo maraya albaabka hore u jiray, taas oo goysa hal wareeg oo gaar ah. Ma ka dhigto hal macmiil qaadaha kan kale, sidaas darteed inta kale ee silsiladda waa naqshaddaada. Meesha silsiladdu u baahan tahay siyaasad halkii waddo, qor qaanuun cad oo isha ama calaamadda ah oo ku tijaabi gaadiidka ay tahay inuu la jaanqaado.
Waxa dhaca marka boodka dibadda uu dhinto
Ka hor inta silsiladda loo tixgeliyo mid dhamaystiran, go'aanso waxa dhaca marka boodka dibaddu uu libdhayo. Gaadiidka macmiilka gudaha ayaa la dhintaa, tallaabada xigtana waa su'aal siyaasad ah oo ma aha mid farsamo: guuldareysi, isku day kale, ama si toos ah dib ugu xiriir xiriirka jireed. Natiijada saddexaad ayaa mudan in laga fikiro. Waxay si aamusnaan ah u beddelaa naqshad laba bood ah mid hal bood ah xilliga uu isticmaaluhu aaminsan yahay in daboolka wali aan la taaban.
Haddii laba bood ay waajib yihiin, macmiilka gudaha waa in aanu awoodin inuu sameeyo waddo toos ah marka kan dibadda maqan yahay, habka loo ogaadana waa in la jebiyo boodka dibadda oo la daawado waxa kan gudaha sameeyo. Qorshaha kaydka ee la ansixiyay waa jawaab sharci ah, laakiin waa in la qoraa, la tijaabiyaa oo la sheegaa. Qorshe kayd ah oo aan cidna diiwaangelin kama duwana baxsad inta lagu guda jiro dib u eegista dhacdo.
DNS iyo qoyska cinwaannada kale waxay ka tirsan yihiin go'aankaas. Baaritaan gudaha lagu soo saaray wuxuu raacaa siyaasadda martigeliyaha laftiisa ee ma aha tan macmiil la gudbiyay, sidaas darteed xalliyaha u shaqeeya gaadiidka la gudbiyay waxaa laga yaabaa inuusan ahayn kan martigeliyaha laftiisu isticmaalo.
Aqbal lakab kasta sida ay u kala horreeyaan dhismahaaga
Ku tijaabi sida ay u kala horreeyaan dhismaha silsiladda: marka hore tunnelka dibadda oo keliya, ka dib gaadiidka macmiilka gudaha oo maraya tunnelka dibadda, ka dib barnaamijka oo maraya tunnelka gudaha. Aqbal kastu waa inuu noqdaa xiriir cusub ee ma aha bog hore u furnaa. Ka dib jebi oo soo celi lakab kasta si gooni ah oo daawado waxa kan xiga sameeyo.
Natiijada qorshaha kaydka ayaa ah indho-indhaynta ugu qiimaha badan halkan, iyo tan aan bogga IP-ga dadweynaha waligiis tusi karin. Kaydi waddooyinka lammaanayaasha, cinwaannada ay isticmaalaan iyo natiijadaas agteeda habaynta, maxaa yeelay waddada farxadda leh ma aha qaybta la weydiiyo mar dambe.