I-hotspot ye-VPN enebhuloho: iyiphi indlela ezenzakalelayo esetshenziswa ucingo?
Indlela ezenzakalelayo ye-Pi ayilona isango locingo. Hlukanisa izinqumo ezimbili, gcina i-uplink ngaphandle kwebhuloho, futhi uhlole i-lease ngaphambi komhubhe.
Ucingo oluse-hotspot yakho enebhuloho luthola ikheli naleso sango endaweni ethile, futhi lokho akulona indlela ezenzakalelayo ye-Pi. Ukushintsha okwezenzakalelayo kwe-Pi kushintsha lapho i-Pi ithumela khona ithrafikhi yayo. Ucingo luyaqhubeka nokusebenzisa isango elitshelwe lona, futhi lapho leso sango likhona ku-LAN ekude, amafremu alo avele awele ibhuloho. Abasebenzisi ababili, izinqumo ezimbili. Ukuhlukanisa lokhu kuchaza iningi lemibiko ye-hotspot engenayo i-inthanethi ngenkathi i-Pi ngokwayo ilungile.
Amadivayisi amabili, izinqumo ezimbili zesango ezihlukene
I-Pi inesitaki sayo se-IP nendlela yayo ezenzakalelayo. Ucingo lunesitaki salo se-IP nendlela yalo ezenzakalelayo.
| Consumer | Who chooses its gateway | What carries the traffic |
|---|---|---|
| Phone on the bridged AP | The remote LAN router, delivered in its client configuration | An Ethernet frame toward that router crosses the AP and TAP bridge |
| Pi's encrypted connection | The travel uplink's route toward the VPN peer | The Pi sends its own outer transport packets over the underlay |
Lelo thebula liwumodeli wonke. Isango locingo likheli eliku-LAN ekude, futhi amafremu alo adluliselwa kusendlalelo 2 ngase-router lowo. Indlela ezenzakalelayo ye-Pi iphathelene nokuthuthwa kwayo kwangaphandle, okufanele kufinyelele i-VPN peer ngokusebenzisa i-uplink yohambo.
Ibhuloho lidlulisa amafremu, alihambisi amaphakethe
Ibhuloho le-Linux lidlulisa amafremu e-Ethernet ngokwe-MAC yendawo, futhi yilokho kuphela elikwenzayo phakathi kwamachweba alo. Ifremu locingo elibhekiswe ku-MAC yesiphuphutheki esikude lishintshelwa echwebeni le-TAP futhi liwela umhubhe ngaphandle kokuthinta ithebula lokuhamba kwe-Pi. Yingakho indlela ezenzakalelayo ye-Pi eyephukile ingashiya ucingo lusebenza, futhi yingakho eyayiyo ingenakho ukulungisa ucingo olunikezwe isango elingalungile.
I-TAP ithwala amafremu e-Ethernet futhi ingaba yichweba lebhuloho. I-TUN ithwala amaphakethe e-IP futhi ayikwazi. Uma ukwakheka kwakho kushintshe elinye ngelinye, ibhuloho akulona ibhuloho futhi okunye lapha akusebenzi.
Nquma ukuthi ubani ohambisa i-lease yocingo
Inketho 3 ye-DHCP iyinketho yesiphuphutheki, futhi itshela iklayenti ukuthi liphi isango elizolisebenzisa kunethiwekhi yalo encane. Lapho iseva ye-DHCP ye-LAN ekude iyiyo kuphela ehambisayo, ucingo luthola isango elikude futhi ukwakheka kuyavumelana. Lapho enye into ohlangothini lohambo iphendula kuqala, ucingo luthola isango lendawo, ithrafikhi yalo ye-inthanethi iphuma nge-uplink yohambo, futhi ithrafikhi yalo eya ku-LAN ekude ayinayo nhlobo indlela.
Qalisa umhambisi oyedwa waleso sizinda sokusakaza, futhi ubhale phansi ukuthi uhambisa ini.
I-Pi iyindawo ehlukile ngisho nalapho ithatha ikheli kuleyo lease. Nquma ngamabomu ukuthi kufanele yini ifake izindlela ezinikezwa yi-lease, ngoba okwezenzakalelayo okude okungenisiwe kungadonsa ukuthuthwa kwe-VPN kwe-Pi uqobo kungene emhubheni elizama ukuwugcina uphila. Nge-systemd-networkd leso sinqumo yi-UseRoutes= esigabeni se-DHCP; nge-dhclient iyinketho ye-routers ohlwini lwezicelo.
Gcina i-uplink ngaphandle kwe-LAN enebhuloho
Isixhumi esithwala uxhumano lwe-VPN lwangaphandle lwe-Pi akumele sibe yichweba lebhuloho. Uma siba yikho, ukuthuthwa okubethelwe kushintshelwa ku-LAN enwetshiwe futhi umhubhe ugcina uthwala amaphakethe awo angaphandle, okuhluleka ngendlela ebukeka njengokulahleka kwamaphakethe hhayi iluphu. Gcina futhi amandla e-AP nokusekelwa kwebhuloho kucacile. Isixhumi esingenantambo esimweni se-station ngokuvamile asikwazi ukuba yichweba lebhuloho, ngoba isihloko se-802.11 asinayo indawo yekheli lesibili le-MAC elidingwa yibhuloho.
Chaza isizinda sokusakaza esinwetshiwe, uhlelo olulodwa lwamakheli, nokuhlunga amafremu okufunayo ngempela. Ukuvumela isilaleli se-VPN ku-Pi akuniki wonke iklayenti elinebhuloho ukufinyelela izinsizakalo zokuphatha ze-Pi. Lezo yimithetho ehlukene, futhi ukuzithatha njengokukodwa yindlela i-hotspot ethi ngokuthula ibe umnyango ovulekile.
Hlola izinto ezine ngokwehlukana lapho kugqashuka
Lapho ucingo lungakwazi ukufinyelela ku-LAN ekude, ukubhekwa okune kuhlukanisa izimbangela. Kugijimise ngale ndlela futhi ume kokokuqala okwehlulayo.
ip route show default
bridge link show
ip -4 neigh show dev br0
tcpdump -ni br0 arp or icmpQala nge-lease: ingabe ucingo lunekheli nesango kunethiwekhi encane ekude? Bheka ibhuloho, futhi uqinisekise ukuthi ichweba le-AP nechweba le-TAP kokubili kuyadlulisa. Bheka ithebula labomakhelwane, ngoba ingeno engaxazululwanga yesiphuphutheki esikude isho ukuthi amafremu ayaphuma futhi akukho okuphendulayo. Ekugcineni bheka amafremu ebhulohweni ngenkathi ucingo lwenza i-ping, lokho kukutshela ukuthi iphutha lingaphansi kwe-IP yini.
Bhala phansi ukuthi iyiphi idivayisi ephethe okwezenzakalelayo ngakunye uma usuqedile. Umugqa owodwa wemibhalo wenza ukuphuma kwendawo nokude kube yisinqumo sekhayenti esenziwe ngamabomu, futhi isethenjwa sebhuloho kufanele sigcinwe eduze kwaso.