Sicishe sivala i-IPv6 ukulungisa ukuvuza kwe-VPN? Kunalokho ncika inqubomgomo
Ikheli le-link-local akulona ukuvuza futhi nomzila we-IPv6 womhlaba wonke awulona. Qala ngokukhetha phakathi kokuvimbela, ukuthwala nokuyeka.
Ikheli elisuka kububanzi be-IPv6 livela ekhasini lokuhlola, umhubhe ngokusobala awulithwali, futhi iseluleko esithandwa kakhulu ku-inthanethi ukuthi kucishwe i-IPv6 yonke indawo. Lowo myalo uthulisa iphaneli ngempela. Kodwa futhi ususa iphrothokholi okungenzeka ukuthi inethiwekhi yokufinyelela incike kuyo, futhi ukushiya ngaphandle kokuqonda ukuthi ikheli kwakuwukuvuza kwangempela, ikheli le-interface le-link-local, noma isixazululi esenza umsebenzi waso. Izimo ezintathu zinquma ukulawula okulungile, futhi kukodwa kuphela kuzo okuholela ekuvimbeleni.
Khomba ukuthi ithuluzi lalikala ini ngempela
Isixwayiso esingelona iqiniso esivame kakhulu ikheli le-link-local, eliqala nge-fe80: futhi elikhona kuwo wonke ama-interface anamandla e-IPv6, kungakhathaliseki ukuthi umshini ufinyelela i-inthanethi nge-IPv6 noma cha. Livela ezinhlelweni zama-interface nakwezinye izixwayiso zezinhlelo zokusebenza, futhi alisho lutho mayelana nomzila wethrafikhi yakho.
Isixwayiso sesibili esingelona iqiniso ikheli lendawo eliyingqayizivele ngaphakathi kwe-fc00::/7, okuyibanga langasese elisetshenziswa ngaphakathi kwenethiwekhi. Ithuluzi eliphrinta wonke amakheli omsingathi lizowabeka ngokujabula eceleni kwelelikhulu. Noma ubani ofunda ngokushesha ulibiza ngokuthi ukuvuza, bese echitha ihora enkingeni engekho.
Eyesithathu akusona isixwayiso esingelona iqiniso nhlobo. Ikheli lomhlaba wonke elifinyelela i-inthanethi ngaphandle komhubhe yikho ukuvuza kwangempela, futhi kufanelekile ukukala ngaphambi kokunquma noma yini:
ip -6 addr show scope global
ip -6 route show default
curl -6 -sS --max-time 6 https://ifconfig.coUma umyalo wokuqala uphrinta ikheli lomhlaba wonke futhi owesithathu ubuyisela ikheli le-IPv6 lomphakathi okungewona owomhubhe, unomzila wangempela ngaphandle komhubhe. Uma owokuqala ungaphrinti lutho ngaphandle kokufakwa kwe-link-local, akukaze kube khona ukuvuza okufanele kulungiswe.
Izimo ezintathu zinquma ukulawula
Isinqumo akusona "i-IPv6 inhle" noma "i-IPv6 imbi". Isinqumo ukuthi usesiphi sezimo ezintathu, futhi ngasinye sinempendulo elungile ehlukile ngezindleko ezihlukile uma wenza iphutha.
| Situation | Correct control | Cost if you disable IPv6 instead |
|---|---|---|
| Exit has no IPv6, host does | Block IPv6 deliberately in the tunnel policy | Same visible result, no documentation of intent |
| Exit carries IPv6, host leaks | Route IPv6 into the tunnel and verify | You lose IPv6 reachability entirely |
| Access network is IPv6-only | Change nothing; use the tunnel's IPv6 | Machine loses connectivity completely |
Umugqa wokuqala yilokho abantu abavame ukukusho, futhi kufanelekile. Iklayenti elinomkhiqizo ongayisekeli i-IPv6 akufanele likhulule ngokuthula ithrafikhi ye-IPv6 yomsingathi iphume, ngoba lokho kuwukuvuza okubhalisiwe kwe-stack ekabili. Iphuzu ukuvimbela njengenqubomgomo emenyezelwe, hhayi ukucisha iphrothokholi ku-kernel. Umphumela obonakalayo uyafana futhi munye kuphela ongabuyekezwa kamuva.
Umugqa wesithathu yilapho iseluleko esijwayelekile siba yingozi ngempela. Abasebenzi bezokuxhumana beselula nokunye ukuxhumana kwasekhaya basebenzisa amanethiwekhi e-IPv6-only anokuhumusha kwezindawo ze-IPv4. Susa i-IPv6 lapho futhi uzosusa ukuthutha okuwukuphela kwako okunikezwa inethiwekhi, okudala ukuphazamiseka okubi kakhulu kunalokho obukulungisa.
Uma umkhiqizo ungenayo i-IPv6, vimbela ngamabomu
Khetha indlela yeklayenti uqobo, ngoba isebenza ngqo ngesikhathi umhubhe uphakeme futhi ihlehla uma uwela. OpenVPN inokukhetha kwalokhu, futhi i-iptables inomthetho olinganayo wamanye amaklayenti:
block-ipv6
ip6tables -A OUTPUT -o eth0 -j REJECT --reject-with ipv6-port-unreachableUmyalelo ungowephrofayela; umthetho ungowodonga lomlilo ongawuhlola futhi uwususe. Kokubili kwehluleka kuvaliwe, okuyikho okukufunayo, futhi kokubili kubonakala kumehluko wokucushwa, okungekho ku-sysctl ye-kernel egqitshwe kusikripthi sokuqala.
Bhala phansi ukuthi kungani ikhona. Umthetho wokuvimbela ongenambhalo uzosuswa umuntu olandelayo odinga i-IPv6 kwenye into, bese ukuvuza kubuya ngokuthula.
Uma umkhiqizo uthwala i-IPv6, wuhambise futhi uhlole imindeni emibili
Ukuthwala i-IPv6 yimpendulo engcono uma iseva iyisekela, futhi akunzima kakhulu. Imfuneko ukuthi i-interface yomhubhe ibe nekheli kulo mndeni futhi umzila wayo ozenzakalelayo ukhombe ngaphakathi komhubhe hhayi ngaphandle kwe-interface ebonakalayo:
ip -6 route get 2606:4700:4700::1111
ip -6 route show default
curl -6 -sS --max-time 6 https://ifconfig.co
curl -4 -sS --max-time 6 https://ifconfig.coUkusesha komzila ukuhlolwa okunqumayo: uma uqoka i-interface yomhubhe, ithrafikhi ye-IPv6 iyathwalwa. Izicelo ezimbili ze-curl bese ziqinisekisa ukuthi umndeni ngamunye ubona ini, futhi ukuziqhathanisa kuyindlela yokuqinisekisa ukuthi zombili izindlela manje ziphuma ngomkhiqizo ofanayo.
Ungami ekuxhumaneni okuphumelelayo. Xhuma kabusha umhubhe bese uhlola futhi, ngoba umzila we-IPv6 ophushiwe ungalahleka ekusungulweni kabusha uma iseva iwuthumela ekucushweni kokuqala kuphela. Bese uhlola indawo eyodwa ekhishiwe, ngoba imithetho ye-split-tunnel yilapho imindeni emibili ihluke kakhulu khona.
Uma inethiwekhi yokufinyelela ingeyo-IPv6 kuphela, yeka
Amanye amanethiwekhi anikeza i-IPv6 kuphela futhi alindele ukuthi idivayisi ifinyelele izinsizakalo ze-IPv4 ngendlela yokuhumusha ohlangothini lomhlinzeki. Ukucisha i-IPv6 kumshini onjalo akusona ukuthuthuka kwezokuphepha; kususa indlela eyodwa yokuya kunoma yini. Lokho ukuphazamiseka ozibangelayo ngenxa yomphumela wokuhlola owawungadingeki muntu.
Uphawu lwephutha lapha luhlukile futhi aluthokozisi: umhubhe ubonakala usungulwa, ukuxazululwa kwamagama kuyasebenza, futhi akukho okulayishwayo. Uma ubona lokho ngemva koshintsho lwe-IPv6, buyisela isilungiselelo ngokushesha futhi uqhubeke nokuxilonga kwenye indawo.
Noma yini oyikhethayo, gcina isinqumo sicacile kuphrofayela noma odongeni lomlilo, sixhumanise nalokho umkhiqizo owusekelayo ngempela, futhi ubhale ukuziphatha kwe-stack ekabili okuchazwa ingxoxo ye-stack ekabili ye-RFC 7359 . Ukuvimbela okumenyezelwe inqubomgomo. Iphrothokholi ecishiwe iyindlela yokuzungeza okungekho muntu ongayihlola, futhi kusukela ekhasini lokuhlola zibukeka zifana.