Wake-on-LAN VPN ka socda ma joojinaysaa shaqada? Hagaaji gelinta ARP
Baakadaha sixirka ah waxay dhex maraan tunnel-ka, laakiin router-ku wuu tuuraa marka gelinta ARP-ga dhacdo. Isbarbardhig saddex waddo oo gudbin ah, ka dibna si joogto ah u xidh ciwaanka MAC.
Dir baakad kicinta isla markiiba daminta ka dib oo kombuyuutarku wuu soo noqdaa; isla amarkaas subaxda xigta waxba ma sameeyo. Waxba kama beddelmin habaynta VPN, oo wareejinta dekeddu waxay weli tilmaamaysaa ciwaanka saxda ah. Farqiga waa wakhtiga: shaxda deriska ee router-ku waxay illowday mashiinka hurda, sidaas darteed ma haysato ciwaan MAC oo lagu geliyo frame-ka. Dhacdadaas, ma aha tunnel-ka, ayaa sharraxaysa inta badan guuldarrooyinka Wake-on-LAN ee VPN-ka.
Kicinta koowaad way shaqaysaa tan xigta ma shaqayso
Router-ku wuxuu frame u gudbiyaa ciwaan gaar ah isagoo ka raadinaya bartilmaameedka shaxda deriskiisa. Inta mashiinku shaqeynayo waxay ka jawaabtaa ARP, sidaas darteed isku-xidhka ayaa cusub ahaanaya. Marka la damiyo, waxba ma jawaabaan, gelintu way duugoobaa dhowr daqiiqo ka dib, oo frame-yada dambe ee ciwaankaas waa la tuuraa inkastoo IP-ga iyo wareejinta dekeddu ansax yihiin.
Qaabku wuxuu kuu sheegayaa guuldarrada aad haysato. Kicin aan waligeed shaqeyn waxay tilmaamaysaa gudbinta: deked khaldan, bartilmaameed khaldan, ama firewall tuuraya baakadda ka hor inta aanay gaarin LAN. Kicin hal mar shaqeeya kadibna saacado guuldarraysta waxay tilmaamaysaa gelinta deriska. Kicin shaqeeya ilaa ijaarka DHCP isbeddelo waxay tilmaamaysaa ciwaanaynta, taas oo kaydku hagaajiyo.
Xaqiiji in ciwaanku xasilloon yahay ka hor inta aadan taaban ARP. Haddii mashiinka hurda uu ciwaan cusub qaato marka ijaarku dhammaado, gelinta deris ee loo xidhay ciwaanka hore waxay noqon doontaa mid joogto ah iyo mid aan faa'iido lahayn isla mar. Marka hore dejiso kayd DHCP si ciwaanku uga badbaado dib-u-kicinta.
Baakadda sixirka ah maxay ka u baahan tahay shabakadda
Culaysku waa fudud yahay: 102 byte oo ka kooban lix byte 0xFF oo ay ku xigto ciwaanka MAC bartilmaameedka lix iyo toban jeer, oo badanaa loo diraa dekedda UDP 9. LAN siman waxay u baxdaa sida faafin, deked kastaa way qaadataa, oo kaadhka shabakadda ee damisan wuu gartaa ciwaankiisa.
VPN-ka dhexdiisa baakaddu waxay router-ka uga soo gaartaa sida uncast ciwaan gaar ah ama sida faafin loo jeediyey subnet-ka. Xaaladda uncast router-ku waa inuu bartilmaameedka u beddelo ciwaan MAC ka hor inta aanu frame-ka dhigin LAN, oo isla beddelkaas ayaa guuldarraysta inta martida hurdada ku jirto.
Qalabka qaarkood waxay u diraan dekedda 7 halkii 9, qalabka qaarkoodna waxay si caadi ah u xiraan faafinta loo jeediyey. Kuwaani waa guuldarrooyin gudbin, ma aha ARP, sidaas darteed hubi bartilmaameedka iyo dekedda ka hor inta aadan beddelin shaxda deriska.
Saddex waddo oo loo maro marti hurda
Waxaad haysataa saddex siyaabood oo wax ku ool ah oo frame-ka LAN lagu keeni karo, doorashada saxda ahna waxay ku xiran tahay waxa aad maamusho.
| Method | What it needs | Where it breaks |
|---|---|---|
| Subnet-directed broadcast | A wake tool that accepts a broadcast address and a router that forwards it | Broadcast filtering, or a tool that only takes a MAC |
| Helper on the LAN | An always-on host such as the VPN server | No suitable host, or the host cannot reach the target VLAN |
| Permanent neighbour entry | Router shell access and the target MAC | NIC replacement or address change |
Dooro martida caawiyaha marka uu jiro, sababtoo ah wuxuu ku faafiyaa xiriirka oo uma baahna wax ka reebid router-ka. Dooro faafinta loo jeediyey marka router-ku horey u oggolaado oo qalabka kicinta uu aqbalo ciwaan. Dooro gelinta taagan marka midkoodna aanu jirin oo aad amarka ku ordi karto router-ka.
Kuwaani isma reebaan. Gelinta joogtada ah waxay sidoo kale u ogolaataa waddada uncast inay ka gudubto hurdada, taas oo faa'iido leh marka macmiilka VPN uu kaliya u diri karo ciwaan gaar ah.
Gelinta deriska ka dhig mid joogto ah
Router leh shell Linux, hal amar ayaa xidha isku-xidhka. Qiimaha halkan ku qoran waxay ka tirsan yihiin LAN tusaale ah waana in lagu beddelo kuwaaga:
ip neigh replace 192.168.50.23 lladdr 3c:7c:3f:12:9a:4e dev br0 nud permanent
ip neigh show dev br0 | grep 192.168.50.23Xaaladda nud permanent waxay gelinta ku haysaa waqtiyada ARP oo waxay u isticmaashaa gudbinta inta mashiinku damisan yahay. Amarka labaad wuxuu caddeeyaa in gelintu jirto oo wuxuu muujinayaa interface-ka ay ka tirsan tahay, taas oo muhiim u ah router-yada leh buundo marti ama VLAN gooni ah.
Ka dhig mid u adkaysta dib-u-kicinta iyada oo loo marayo qabasho kasta oo firmware-ku bixiyo: script ku yaal /jffs/scripts Asuswrt-Merlin, unug systemd oneshot oo ku yaal server Linux oo gateway ah, Neighbor= stanza ku yaal systemd-networkd, ama gelin ku yaal /etc/ethers oo qalabka maxalliga ah akhriyaan. Amar lagu qoray shell wuu lunto dib-u-kicinta xigta, waana sababta ugu caansan ee xalka shaqeynayay uu u muuqdo mid joojiyay shaqada.
Ka tijaabi bannaanka oo ogow goorta la tirtiro
Mashiinka seexi oo sug ugu yaraan toban daqiiqo, ku filan in gelin kasta oo firfircoon duugoobto. Kadib u dir codsiga kicinta macmiilka VPN oo fiiri labada dhinac ee router-ka:
tcpdump -ni tun0 udp port 9
tcpdump -ni br0 ether proto 0x0806 or udp port 9Qabashada koowaad waxay caddeynaysaa in baakaddu ka timid tunnel-ka; tan labaad in router-ku frame dhigtay LAN. Baakad sixir ah oo ansax ah waxay u muuqataa 102 byte oo MAC-ku ku celceliyo, sidaas darteed hubi dhererka iyo bartilmaameedka. Haddii frame-ku ka baxo buundada LAN oo mashiinku damisan sii ahaado, dhibaatada hadhay waxay ku jirtaa qalabka: bilaabid degdeg ah, hurdo qoto dheer ama dejinta BIOS oo gooya korontada kaadhka shabakadda.
Tirtir gelinta marka kaadhka shabakaddu isbeddelo, oo cusboonaysii marka aad mashiinka u rarto ciwaan kale. Isku-xidh joogto ah waa ka reebid ula kac ah, oo ka reebid aan cidina xusuusanayn waa sida kombuyuutar laabta ah mustaqbalka uu u bilaabo helitaanka frame-yo loogu talagalay desktop hawlgab ah.