Kungani ukuvimba yonke i-ICMP kudiliza umzila we-VPN osebenza
Imilayezo yempendulo mayelana nosayizi ayizona izimpendulo ze-ping. Uma ingafiki neze, amaphakethe amancane ayadlula, amakhulu ayanyamalala, futhi ithuneli libonakala lingcikiza.
Ithuneli eliqeda ukuqinisekisa, lithwale i-ping bese limile ekudluliseni kokuqala okukhulu uphawu lwakudala lomlayezo we-ICMP olahlekile, hhayi i-VPN ephukile. Umthumeli akakaze azi ukuthi iphakethe lalilikhulu kakhulu, liphinda usayizi ofanayo, futhi uhlelo luyalinda. Ukulungisa lokhu isinqumo senqubomgomo ye-firewall, hhayi ukufaka kabusha iklayenti. Ukulandelana kubalulekile: linganisa ukuthi umngcele wosayizi ukuphi, bese unciphisa umthetho ogwinye umbiko.
Yini i-ICMP eyithwalayo ngempela kulo mzila
Ukutholwa kwe-MTU yomzila we-IPv4 kuncike ekutheni umhleli womzila abike ukuthi iphakethe elinebhithi le-don't-fragment alikwazanga ukudluliswa. Lowo mbiko umlayezo we-ICMP Fragmentation Needed, futhi ngaphandle kwawo umthumeli akanasizathu sokunciphisa usayizi wengxenye yakhe. I-IPv6 inzima kakhulu: abahleli bomzila abahlukanisi phakathi nokudlula, ngakho umlayezo we-ICMPv6 Packet Too Big uwuphawu kuphela olwenza umthumeli unciphe.
Yomibili imilayezo iyimpendulo yezinga lokulawula, futhi akukho eyodwa eyimpendulo yokuxilonga. Inqubomgomo evimba i-ping kanye nenqubomgomo evimba yonke i-ICMP zibukeka zifana ohlwini lwemithetho kodwa ziziphatha ngendlela ehluke kakhulu kunethiwekhi. Eyesibili ingaguqula ithuneli elilinganiswe kahle libe umzila wohlangothi olulodwa kukho konke okukhulu kunokuxhumana okuncane kakhulu ochungechungeni.
Ezinye izinto zokuthutha zisebenzisa ukutholwa kwazo ngamaphakethe okuhlola, njengoba i-RFC 4821 ichaza, futhi zincike kancane kulempendulo. Lesi isizathu sokuhlola ukuthi yikuphi ukuthutha okusebenzisayo, hhayi ukucabanga ukuthi yonke ithuneli ayinakulimala.
| Umlayezo | Inhloso emzileni | Uma ivinjiwe |
|---|---|---|
| ICMPv4 uhlobo 3 ikhodi 4 | Iphakethe lalilikhulu kakhulu kokuxhumana okulandelayo | Umthumeli uyaphinda futhi ayame |
| ICMPv6 uhlobo 2 | Packet Too Big, okulingana ne-IPv6 | Ukuma okufanayo, ngaphandle kwenye indlela yokuhlukanisa |
| ICMP uhlobo 11 | Isikhathi sedlule, kusetshenziswa i-traceroute | Ukuxilonga kulahlekelwa izingxenye, ithrafikhi isahamba |
| Isicelo nempendulo yomsindo we-ICMP | Ukuhlolwa kokufinyeleleka | I-ping iyahluleka, umzila ungase ulungile |
Ukwehluleka kuncike kusayizi
Buza ukuthi ukwehluleka kuhlobene nosayizi wephakethe. Ikhasi lokungena, umbuzo we-DNS kanye nocingo olufushane lwe-API kuyaphumelela, kuyilapho ukulayisha ifayela, impendulo enkulu noma ukulanda isithombe kuma. Leli phethini likhomba emngceleni wosayizi endaweni ethile phakathi kweziphetho ezimbili, hhayi ukuqinisekisa noma umzila. I-ping encane ephumelelayo ayisho cishe lutho mayelana nokuthi lowo mngcele ukuphi.
Ngaphakathi kwethuneli kunezendlalelo ezimbili okufanele zicatshangelwe: iphakethe lomthwalo kanye nephakethe langaphandle eligoqiwe. Umthumeli wangaphakathi angaziphatha kahle kuyilapho umzila wangaphandle uncane kunalokho ithuneli elicabangayo, yingakho kokubili ukusethwa kwe-MTU yethuneli kanye nokuxhumana komzimba ngaphansi kwalo kubalulekile.
Linganisa ngaphambi kokuhlela imithetho
Hlola ngebhithi le-don't-fragment kanye nosayizi womthwalo oyikhethayo, kusukela kuklayenti elihlulekayo kuye ekhelini elivikelwe:
ping -M do -s 1472 10.20.5.7
ping -M do -s 1300 10.20.5.7Umthwalo wamabhayithi angu-1472 kanye namabhayithi angu-28 ekhanda kwenza iphakethe lamabhayithi angu-1500. Uma ukuhlola okukhulu kuhluleka ngephutha lokuhlukanisa kanti okuncane kuyadlula, utholile umngcele; lungisa ngenxa yomthwalo owengeziwe wethuneli futhi uphinde kuze kube usayizi osebenzayo uzinzile.
Bese uqinisekisa ukuthi igebe ngumbiko uqobo. Uma ukuhlola kuhluleka buthule, ngaphandle kwephutha nempendulo, umlayezo cishe uyalahlwa hhayi ukulethwa, futhi umthetho ungumsolwa.
Nciphisa umthetho, bese uphinda uhlole umsebenzi
Ukulungiswa kufanele kuvumele imilayezo ethile yokulawula, hhayi yonke iphrothokholi. Kumphathi we-iptables uhlobo luwukwamukela okuqondene nohlobo; lungisa isintaksi kulokho okuphatha i-firewall endaweni yakho:
iptables -I INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
ip6tables -I INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPTShiya izimpendulo zomsindo zivinjiwe uma kuyinqubomgomo yasendaweni, ngoba umzila awuzidingi. Bese uphinda uhlole ukudluliswa okwahluleka ekuqaleni, kusukela kuxhumano olusha, futhi uqinisekise ukuthi izibali zomthetho zibonisa imilayezo ifika.
Uma ukudluliswa okukhulu kusamele kume ngemva kokuvunyelwa kwemilayezo, umngcele osele ukwenye indawo: i-MTU yethuneli esethwe phezulu kakhulu, i-proxy ebhala kabusha amaphakethe, noma ibhokisi eliphakathi elilahla esikhundleni sokubika. Umthetho we-ICMP wawudingekile, awanele.