Ukudlulisa iphakethe langaphakathi elingaguquki lamabhayithi angu-1,500 nge-VPN

Unemfuneko engaguquki: uhlangothi olukude kufanele luthole iphakethe le-IP lamabhayithi angu-1,500 elifanayo nalelo elikhishwa umthumeli, kufaka nezihloko. I-tunnel ayikwazi ukugoqa lelo phakethe kanye ne-framing yayo ngaphakathi kwephakethe lesibili le-IP lamabhayithi angu-1,500, ngakho okuthile kumklamo kufanele kuvume. Ukulandelana okungezansi yikho engikubona kusetshenziswa ku-window yoshintsho: bhala isabelomali samabhayithi, khombisa ukuthi i-underlay ingathwala ini ngempela, bese ukhetha indlela eyodwa yokuthwala bese uqinisekisa iphakethe langaphakathi ohlangothini olukude.

Bhala isabelomali samabhayithi ngaphambi kokuhlela iphrofayela

I-encapsulation yengeza amabhayithi ezingxenyeni eziningana, futhi isamba siyisici sephrofayela yakho hhayi into engaguquki ongayithola. Umndeni wekhasi, ukukhethwa kwe-cipher, iphrothokholi yokuthutha kanye nanoma iyiphi inketho yokucindezela noma ye-framing kuhambisa inombolo, ngakho ukukhipha okukopishwe kwesinye isakhiwo akunasisekelo njengesabelomali. Qala emfunekweni yangaphakathi, engeza i-overhead elinganisiwe ngephakethe ngalinye yokuhlelwa kwakho, bese ubhala usayizi wangaphandle ophumayo kutikithi yoshintsho ngaphambi kokuba othile ahlele ifayela.

Izinombolo ezimbili zinquma umklamo: iphakethe elikhulu kakhulu langaphandle elithwalwa indlela ngaphandle kwe-fragmentation, namabhayithi engeziwe adingwa yi-encapsulation yakho. Uma elokuqala lincane kunelesibili kufakwe u-1,500, elinye lawo kufanele lishintshe. Ukukhetha bese kuba mncane hhayi kokudala, ngakho ngibhala zombili izinombolo ngaphambi kokuxoxa ngezinketho. Akukho lutho esigabeni se-tunnel okucindezela lawo mabhayithi, futhi ayikho inombolo ephelele ye-MTU eyoqeda imfuneko oyinikiwe.

Hlola i-underlay nge-ping ye-do-not-fragment

Linganisa indlela esikhundleni sokwethemba i-MTU yesixhumi, ngoba isixhumanisi esincane kakhulu endleleni yangaphandle yiso esibalulekile. Ku-Linux, -M do ibeka ibhithi ye-do-not-fragment futhi -s ithatha i-payload ye-ICMP, ngakho ifreyimu yamabhayithi angu-1,500 iphendula ngamabhayithi angu-1,472 e-payload uma kukhishwa isihloko se-IP samabhayithi angu-20 nesihloko se-ICMP samabhayithi angu-8. Khweza i-payload kuze kuhluleke ukuhlola, bese ugxuma usayizi we-jumbo ukuze ubone ukuthi indlela iyithwala ngempela yini.

ping -M do -s 1472 -c 2 198.51.100.10
ping -M do -s 8972 -c 2 198.51.100.10
tracepath -n 198.51.100.10

Indlela edlula ku-1,472 yehluleke ku-8,972 ayikwazi ukuthwala iphakethe langaphakathi lamabhayithi angu-1,500 kanye ne-overhead kuphela iphakethe elilodwa langaphandle. Yilowo mpendulo owawuyidinga ngaphambi kokuvula ukuhlelwa kwe-VPN. Iphinde inqume ukuthi yimuphi kwezigaba ezimbili ezilandelayo osebenza kuwe, ngakho gcina yomibili imiphumela yokuhlola eduze kwetikithi. Ukuqagela lapha kubiza i-window yesondlo eyodwa, ngoba i-tunnel ezibika ngokuthi ise-up ayikutsheli lutho ngephakethe elikhulu kakhulu indlela ezolamukela.

Khweza i-MTU yendlela kuphela lapho wonke ama-hop evumelana

Amafreyimu e-jumbo ayisici se-end-to-end, hhayi isilungiselelo osivula kumaphoyinti amabili wokugcina okuvele uwalawule. Zonke izitshi, amaroutha kanye nokudluliswa komhlinzeki endleleni yangaphandle kufanele kuvumelane nosayizi omkhulu, futhi i-hop eyodwa yamabhayithi angu-1,500 izolahla buthule iphakethe osanda kulisiza. Ukuphakamisa kuphela isixhumi sasendaweni wushintsho oluyingxenye olujwayelekile olwenza i-tunnel ibonakale iphukile kuyilapho i-underlay ilahla buthule.

ip link set dev eth1 mtu 9000
ip link show dev eth1
ping -M do -s 8972 -c 2 198.51.100.10

Shintsha isixhumi, bese uhlola futhi leyo ndlela ngaphambi kokushintsha enye into. Uma ukuhlola kusahluleka, buyisela emuva nge- ip link set dev eth1 mtu 1500 bese udlulela ku-fragmentation esikhundleni sokuphikisana nomhlinzeki ngesixhumanisi okungewona owakho.

Sebenzisa i-fragmentation ye-tunnel uma i-underlay ingakwazi ukukhula

Indlela ye-fragmentation esekelwayo ngaphansi kwephakethe langaphakathi ivumela amaphakethe amaningi angaphandle ukuthwala iphakethe elilodwa langaphakathi, futhi iphoyinti lokugcina le-tunnel elibhekene nalo liwahlanganisa futhi ngaphambi kokunikeza okwangempela ku-stack. Inketho ye-UDP fragment ye-Community OpenVPN ingenye yezindlela zokusebenzisa lowo mqondo, futhi ayifani ne-fragmentation evamile ye-IP yephakethe langaphandle. Womabili ama-peer kufanele asebenzise inguqulo esekela leso sakhiwo, futhi indlela yedatha kufanele ibe yileyo oyicabangayo: amaklayenti e-OpenVPN 3 neziteshi zedatha ezisheshiswa yi-kernel zinemikhawulo ehlukene, ngakho iphrofayela esebenza kuklayenti eyodwa ingahluleka kwesinye.

openvpn --config client.ovpn --tun-mtu 1500 --fragment 1400 --verb 4

I-fragmentation evamile yangaphandle ingenye inketho, futhi inesithakazelo esiphansi. Amaroutha e-IPv6 awahlukanisi neze iphakethe elidluliswayo, ngakho iphakethe elikhulu kakhulu langaphandle lishona nje futhi umthumeli ufunda ngakho kuphela uma umlayezo we-ICMPv6 ofanele usuphila endleleni. Izingcezu ziphinde zimeme ukuhlunga nokwanda kokulahlekelwa, ngakho ngikubheka lokhu njengendlela yokubuyisela emuva hhayi njengecebo.

Isithwali sangaphandle esisekelwe ku-stream siyagwema umbuzo wosayizi ngokuhlukanisa i-stream yayo yamabhayithi, futhi iphakethe langaphakathi elakhiwe kabusha lingaba ngamabhayithi angu-1,500. Leso isinqumo sokuthutha esinezindleko zaso, kufaka nokuziphatha okwaziwayo kwe-TCP ngaphakathi kwe-TCP, ngakho thatha ngamabomu hhayi njengomphumela oseceleni wengxabano ye-MTU.

Qinisekisa ukuthi iphakethe langaphakathi lifika lingashintshile

Ukuqinisekisa akukona i-handshake ephumelele. Thwebula kusixhumi se-tunnel kuzo zombili izingxenyekazi bese uqhathanisa usayizi nokuqukethwe kwephakethe elithunyelwe ngempela uhlelo lokusebenza nalelo elatholwa uhlangothi olukude.

ip link show dev tun0
ping -M do -s 1472 -c 2 10.8.0.1
tcpdump -ni tun0 -c 5 'icmp and greater 1000'

Uma ukuthwebula kukhombisa iphakethe langaphakathi elinosayizi ogcwele kwelinye icala, ukukhetha kokuthwala kuyasebenza futhi umsebenzi osele ukuwubhala phansi. Uma kungakhombisi lutho ngenkathi i-tunnel izibika njenge-up, iphakethe langaphandle liyalahlwa endaweni ethile phakathi kwamaphoyinti okugcina, okubuyisela emuva ekuhloleni hhayi kuzilungiselelo ze-cipher.

Bhala izinto ezintathu kutikithi yoshintsho ngaphambi kokuyivala: isabelomali sangaphandle esilinganisiwe, indlela oyikhethile kanye nomyalo okhombise ukuthi iphakethe langaphakathi lasinda. Umuntu olandelayo ozothinta le tunnel uzodinga zontathu, futhi akukho nokukodwa kuzo okungakhiwa kabusha kusuka kufayela lokuhlelwa kuphela.