Kungani i-net.ipv4.conf.default.forwarding ingathinti i-tun0

Ususele net.ipv4.conf.default.forwarding=1, uqalise kabusha i-VPN, futhi i-tunnel isalahla amaphakethe okufanele i-gateway iwaphathise indlela. Isilungiselelo sibonakala silungile efayelini, futhi i-interface isabika ukuthi ukudlulisela kucishiwe. Akukho okonakele: ushintshe inani elizozuzwa ngofuzo ngama-interface azayo, hhayi lelo elisetshenziswa i-tunnel esebenzayo.

Hamba nalokhu kusibambi esiphethe i-tunnel, ku-namespace yenethiwekhi lapho i-tunnel ikhona khona ngempela. I-container noma i-namespace yenethiwekhi ingabamba i-interface ngenkathi isibambi sikhombisa ezinye izinombolo.

Funda lawa manani amathathu ndawonye

Qala ngokuqhathanisa iswishi yegateway yonke, isifanekiso sama-interface amasha kanye ne-interface okhathazekile ngayo. Faka esikhundleni se-tun0 i-interface yangempela yokungena, futhi ufunde ne-interface yokubuya, ngoba ukudlulisela kuhlolwa endaweni lapho iphakethe lifika khona.

sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.default.forwarding
sysctl net.ipv4.conf.tun0.forwarding

Umphumela ojwayelekile ukuthi ip_forward = 0, default.forwarding = 1 futhi tun0.forwarding = 0. Amabili okuqala awavumelani ngendima yesibambi, futhi elesithathu likhombisa ukuthi i-interface yenzani ngempela. Le nhlanganisela ihambisana nesibambi esingakaze silungiselelwe njenge-router, sathola inani lesifanekiso kuphela. Lezi zinombolo ezintathu aziphikisani; ziphendula imibuzo emithathu ehlukene. Ukubhala inani lesifanekiso nakho akunqumi indima yesibambi.

Kungani iswishi yomhlaba wonke iyona ehambayo

net.ipv4.ip_forward iwukulawula kwegateway yonke. Ukuyishintsha kubuyekeza izilungiselelo zokudlulisela ze-interface ngayinye njengengxenye yomsebenzi ofanayo, yingakho ukubhala okukodwa kungenza i-tunnel ekhona iqale ukudlulisela. default.forwarding ihlwanyela kuphela ama-interface aqalwa ngemuva kwalokho, ngakho i-tunnel eyayivele ikhona igcina inani eyazalwa nalo.

Imibhalo ye-kernel imaka i-ip_forward njengekhethekile ngesizathu esihlobene: ukuyishintsha ibuyisela iqoqo lamanye amapharamitha e-IPv4 kumadefaulti esibambi noma e-router. Lokho kuyenza ibe yithuluzi elibuthuntu. Ukuyisetha kanye njengengxenye yokusungula indima yegateway kulungile; ukuyishintsha ngokuphindaphindiwe njengeqhinga lokulungisa iphutha kungabhala kabusha ngokuthula isilungiselelo osichithe isikhathi usilungisa.

Amanani e-interface ngayinye nawo akhona ngesizathu. I-gateway ephethwe ngamabomu ingagcina ukudlulisela kucishiwe ku-interface okungafanele neze iphathe indlela, ngisho nangenkathi isibambi sidlulisela kwenye indawo. Yingakho ukufunda i-interface esebenzayo kubalulekile nokuthi inani lomhlaba wonke lodwa akulona impendulo ephelele. Funda isikhonyane esinjalo njengesinqumo esenziwe ngamabomu, futhi ubhale ukuthi kungani leyo interface ihlukile. Uma kungenjalo unjiniyela olandelayo uzoyi"lungisa" ngomusa.

Yenza isilungiselelo sibe ngokuhlala njalo endaweni efanele

Ukusebenza kanye sysctl -w okuphumelelayo kufakazela ukuthi i-kernel iyalemukela lelo nani. Akuhlali ngemva kokuqalwa kabusha, futhi akuhlali ngemva komphathi wenethiwekhi ophinda asebenzise umbono wakhe wesilungiselelo se-interface lapho exhuma kabusha. Faka indima yegateway efayelini lesilungiselelo se-sysctl noma kumphathi wenethiwekhi ongumnikazi wesibambi, bese uqalisa kabusha insizakalo eyisebenzisayo.

Ukulandelana kubalulekile kuma-tunnel. Uma umphathi edala i-interface ngesikhathi sokuqalisa futhi esebenzisa ukudlulisela ngemuva kwalokho, i-interface ingazuzwa ngofuzo idefaulti endala. Ukuqalwa kabusha kwensizakalo edala kabusha i-tunnel nakho kuyisigameko sokudala, futhi kulula ukukushiya lapho i-unit ibonakala iphilile. Hlola ukulandelana, hhayi okuqukethwe kokugcina kwefayela kuphela.

Funda futhi lawo manani amathathu ngemva kokuthi i-VPN ixhume kabusha nangemva kokuqalwa kabusha. I-tunnel esanda kudalwa iyinterface entsha, futhi i-interface entsha ithatha idefaulti esebenzayo ngesikhathi sokudalwa. Uma izinombolo zishintsha phakathi kwalezi zigameko, isilungiselelo sisetshenziswa into ongakayihlonzi.

Ungakulungisi lokhu ngethuluzi elingalungile

Ngesikhathi ukudlulisela kubonakala kuphukile, isilingo siwukusula i-firewall noma ukwengeza i-masquerading. Akukho kukho okubili okubhekana neswishi yokudlulisela. Isimo sokudlulisela, imvume yokudlulisela, umzila oya endaweni ehlosiwe kanye nomzila wokubuya kuyizimfuno ezine ezihlukene, futhi eyokuqala kuphela eyi-sysctl.

Hlola futhi ngokugeleza okulungile. Isicelo esenziwe kuyi-gateway uqobo asilolonge neze ukudlulisela; kuwuthrafikhi odalwe endaweni. Umbuzo uwukuthi ingabe iphakethe elivela kuklayenti le-VPN noma kusibambi se-LAN liyamukelwa futhi liphathiswa indlela phambili, ngakho ukuhlolwa kufanele kuqale ngemva kwe-gateway.

Hlukanisa icala le-IPv6

Lapha konke kuyi-IPv4. Ukudlulisela kwe-IPv6, izimemezelo ze-router kanye nokuziphatha kwe-accept_ra kunokulawula kwazo, futhi ukukopisha umzila ipv4 kusilungiselelo se-ipv6 kukhiqiza ifayela elibonakala lithembekile futhi elingenzi lutho olusizo. I-gateway eneziteki ezimbili idinga ukuthi womabili amaqoqo alungiselelwe ngamabomu.

Ukuhlolwa kokugcina: ngemva kokuthi amanani avumelana, qinisekisa ukuthi umzila we-tunnel ukhethwa wendawo ehlosiwe nokuthi umzila wokuphendula ukhona. Ukudlulisela okuvuliwe ku-interface engenawo umzila kuseyigodi elimnyama, futhi lokho kwehluleka kubonakala kufana ngasohlangothini luklayenti.