Engeza i-IPv6 yangasese elabhorishini ye-OpenVPN, iphuzu lokuhlola elilodwa ngesikhathi

Gcina ukuthutha kwangaphandle ku-IPv4 futhi wandise uhlelo lwangaphakathi. Amaphuzu amahlanu okuhlola: ama-prefix, umsizi, ukusunduza umzila, ukudlulisela kanye nokuhlola ohlangothini lwekhasimende.

Usuvele unekhasimende elixhumanisa nge-IPv4 futhi lifinyelela umthwalo we-IPv4 wangasese ngemuva kweseva. Umgomo uwukufinyelela umthwalo we-IPv6 wangasese ngomhubhe ofanayo ngaphandle kokuthinta ukuthutha kwangaphandle. Lokho kuhleleka kubalulekile: indlela yangaphandle ihlala iyi-IPv4, futhi kushintsha kuphela uhlelo lwamakheli lwangaphakathi, umzila wekhasimende kanye nendlela yokubuyela esuka kuseva iye ku-LAN. Amaphuzu amahlanu okuhlola, ngalinye linokuthile okuqondile okumele kubhekwe ngaphambi kokuqhubeka.

Iphuzu lokuqala lokuhlola: uxhumano osebenza kakade

Xhuma ikhasimende futhi uqinisekise indlela ye-IPv4 ngaphambi kokwengeza noma yini. Umhubhe osebenzayo ukunikeza umugqa oyisisekelo ohlukanisa iphutha elisha le-IPv6 enkingeni yakudala yoxhumano. Likutshela futhi ukuthi yikuphi ukusetshenziswa kweseva okuhlelayo ngempela.

Bhala iphuli, i-topology nemizila esunduziwe oseuthembile kuyo. Umsebenzi we-IPv6 welula lokho kulungiselelwa; awukushintshi.

Iphuzu lesibili lokuhlola: khetha ama-prefix angaphakathi

Khetha i-ULA /48 yesayithi bese usika ama-/64 amabili kuyo: elilodwa lamakhasimende omhubhe, elilodwa lengxenye ye-LAN ephethe umthwalo we-IPv6. Khiqiza i-ID yomhlaba wonke engama-40-bit esikhundleni sokukopisha i-prefix eyisibonelo, bese uhlola kokubili ama-subnet ngakunye kunethiwekhi ngayinye isayithi eseyihambisa kakade:

Outer transport: IPv4 OpenVPN UDP
IPv4 pool:       10.90.0.0/24
IPv6 VPN pool:   fd73:93bc:b6e9:77::/64
IPv6 LAN:        fd73:93bc:b6e9:60::/64
Server LAN IPv6: fd73:93bc:b6e9:60::1

Ama-/64 amabili azimele avimbela ukuthi iphuli lamakhasimende isikwe lisuke engxenyeni ye-LAN, lokho okubalulekile kamuva lapho ubhala umzila wokubuyela. Amanani angenhla ayisibonelo esisetshenziwe, hhayi i-prefix yokusetshenziswa kabusha.

Iphuzu lesithathu lokuhlola: engeza umsizi nokusunduza umzila

Funda ukulungiselelwa kweseva kwamanje ngaphambi kokwengeza noma yini. Ikhophi yesibili yomyalo okhona ayihlangani neyokuqala, futhi iphutha elivelayo libiza umyalo hhayi i-IPv6. Uma umsizi we-IPv4 ekhona, imigqa emibili uyelula. Ngamunye uphendula umbuzo ohlukile:

server-ipv6 fd73:93bc:b6e9:77::/64
push "route-ipv6 fd73:93bc:b6e9:60::/64"

Owokuqala umsizi olula ohlela i-interface kanye nephuli lamakhasimende. Owesibili ubiza indawo ye-LAN okumele ikhasimende ifinyelele kuyo. Ukunikeza ikhasimende ikheli le-IPv6 akukutsheli ukuthi yimaphi amanethiwekhi angemuva kweseva, ngakho kudingeka imigqa yomibili.

Umsizi awuhlali kanye nephuli le-IPv6 elingaguquki noma nopool. Uma ukusetshenziswa kunikeza amakheli ngendlela engaguquki ngamabomu, gcina leyo nqubomgomo bese wenza i-IPv6 efanayo ngokucacile esikhundleni sokususa inqubomgomo ukuze ihambisane nesibonelo.

Iphuzu lesine lokuhlola: ukudlulisela kanye nomzila wempendulo

Vula ukudlulisela kwe-IPv6 kuseva ngokusebenzisa umnikazi wokulungiselelwa kohlelo uqobo, hhayi ngokubhala kanye ngesikhathi sokusebenza okuzokhohlwa. Ifomu lesikhathi sokusebenza liwusizo ekuhloleni okusheshayo. Ukulungiselelwa okuhlala njalo kusefayeleni le-drop-in elifundwa umnikazi wenethiwekhi yokusabalalisa:

sysctl -w net.ipv6.conf.all.forwarding=1

Ukudlulisela kushintsha ukuziphatha kwe-IPv6 kwesibungu ngaphezu kokuhambisa amaphakethe. Isibungu esamukele izimemezelo ze-router njengekhasimende siyeka ukwenza kanjalo ngendlela efanayo lapho siqala ukudlulisela. Ngakho umshini okuxhumana kwawo okuphezulu kwe-IPv6 kuncike kuma-RA udinga uhlelo olucacile lwalokho kuxhumana.

Bese unikeza i-LAN umzila wokubuyela kuphuli lomhubhe. Isango le-IPv6 lomthwalo womsebenzi i-router ye-LAN, hhayi iseva ye-VPN, ngakho umzila usuku-router futhi ukhomba ekhelini le-LAN leseva:

ip -6 route add fd73:93bc:b6e9:77::/64 via fd73:93bc:b6e9:60::1

Gcina izinhlobo ze-ICMPv6 ezidingwa yisixhumanisi, kuhlanganise nempendulo ye-MTU yomzila. Umthetho wothango lomlilo we-IPv4 awusho umthetho we-IPv6, futhi ukuvimba i-IPv6 ngokuphelele kuphula ukutholwa komakhelwane ngendlela ebukeka njengephutha lomzila.

Iphuzu lesihlanu lokuhlola: funda ikhasimende, bese uhlola

Xhuma ikhasimende futhi ufunde amakheli eliwatholile ngempela esikhundleni sokuqagela kusukela ekhelini lomsizi weseva. Uhlu lwe-interface lukhombisa imindeni yomibili kudivayisi eyodwa:

ip -6 addr show tun0
ip -6 route get fd73:93bc:b6e9:60::20

Umzila okhetha umhubhe ufakazela ukuthi ikhasimende liyazi lapho lizothumela khona iphakethe. Awufakazeli ukuthi iseva iyalidlulisela, ukuthi i-router ye-LAN inomzila wokubuyela, noma ukuthi uhlelo lokusebenza luvunyelwe ukuphendula.

Hlola uhlelo lokusebenza ngokwalo kumndeni ngamunye ngokulandelana, bese uphinda ngemuva kokuxhuma kabusha nangemuva kokuqalisa kabusha isibungu. Umzila noma i-sysctl ehlala kuze kube ukuqalisa kabusha kuyisivivinyo, hhayi umklamo.

Shicilela irekhodi le-AAAA kuphela lapho indlela ye-IPv6 iphendula kusukela ekuqaleni kuze kube sekugcineni. I-DNS ebuzwe nge-IPv4 isengabuyisela ikheli le-IPv6, ngakho igama elingaxazululwa akulona ubufakazi bokuthi kukhona okulalelayo. Umhlahlandlela we-RFC 4193 we-ULA uhlanganisa ukukhiqizwa kwe-ID yomhlaba wonke eyenza lawa ma-prefix abe ngawakho hhayi ikhophi.

Izihloko ezihlobene