I-EoIP phezu kwesixhumanisi se-VPN se-LTE: ukwakha ilebhu encane ye-RouterOS

I-EoIP ithatha ifreyimu ephelele ye-Ethernet, iyisonge ku-GRE bese iyithumela ekhelini elikude elilungisiwe, yingakho umphumela uziphatha njengekhebula hhayi njengomzila. Okukhishwa irawutha iwumthetho we-IP 47 onifreyimu yasekuqaleni njengomthwalo, ngakho ukusakaza, i-ARP nezimiso ezingezona i-IP konke kuyadlula. I-GRE ayengezi mfihlo yayo, futhi ifreyimu ihlala ifundeka kunoma yini ebona iphakethe langaphandle. Lelo qiniso elilodwa linquma ukulandelana kwalelebhu: akhe umzila obethelwe kuqala, bese uthwala i-Ethernet ngaphakathi kuwo.

Yini eysongwa yi-EoIP, nokuthi yini engayisongi

Ukugqunywa kuyo yonke indlela. Ifreyimu ifika ephothweni elisebhulohweni, ithole isihloko se-GRE nesihloko se-IP sangaphandle, bese inikezwa irawutha egxilile, eyikhipha kokubili bese ifaka ifreyimu ebhulohweni layo. Ibhuloho elamukelayo lifunda i-MAC yomthombo njengoba lingayifunda ephothweni lendawo. Akukho lutho kuleyo nqubo oluqinisekisa ifreyimu noma oluyifihla.

Ngakho imfihlo kufanele ivele emzileni okuhamba kuwo iphakethe le-GRE. Kulomklamo isendlalelo esingezansi iwumhubhe we-WireGuard noma i-IPsec phakathi kwamarawutha amabili, futhi i-EoIP ithwalwa ngaphakathi kuwo. I-MikroTik iphinde inikeze ukukhetha kwe-IPsec okuzenzakalelayo ku-interface ye-EoIP uqobo, okuwukuhlelwa okunye futhi akusikho okulungiswa yilelebhu.

Kumasevisi e-IP anomzila, i-VPN enomzila iwumklamo omncane futhi yiwona okufanele ukhethwe kuqala. Iya esigabeni sesibili kuphela lapho idivayisi idinga ngempela ukubona amafreyimu e-Ethernet avela kwenye isayithi.

Izidingo zangaphambili: isendlalelo esingezansi esibethelwe kanye namaphothi amabili angasetshenziswanga

Womabili amarawutha adinga isixhumanisi esibethelwe esisunguliwe kanye nekheli kuso iqembu elingafinyelela kulo. Uhlangothi lwe-LTE luqala ukuxhumana kwangaphandle, ngakho ihabhu ayishayeli inethiwekhi ephathekayo, futhi irawutha le-LTE ligcina isimo se-NAT esifunwa umhlinzeki. Qinisekisa ukuthi umhubhe uyasebenza ngaphambi kokwengeza noma yini phezu kwawo, ngoba i-interface ye-EoIP engafinyeleli ikheli layo elikude ibonakala ifana ncamashi naleyo elungiswe kabi.

Irawutha ngalinye liphinde lidinge iphothi elingakabi ilungu lebhuloho, i-trunk ye-VLAN, i-interface yokuphatha noma isixhumanisi sokukhiqiza. Ilebhu eboleka iphothi elisebenzayo ayilona ilebhu, futhi indlela yokwehluleka isiphepho sokusakaza kunethiwekhi esebenzayo. Hambisa ukuphatha kwenye i-interface noma ku-console ngaphambi kokuqala.

Hub tunnel address:    10.44.7.1/32
LTE tunnel address:    10.44.7.2/32
Lab ports:             ether7 on both routers, unused
Test hosts:            192.168.77.11/24 and 192.168.77.12/24

Lawa mavelu ayisibonelo hhayi isidingo. Kufanele abe sema-interface omhubhe futhi ahanjiswe ngomzila ovikelwe. Inqubomgomo ye-firewall kuwo womabili amarawutha kufanele ivumele i-GRE phakathi kwamakheli amabili omhubhe, futhi i-GRE iwumthetho we-IP 47, hhayi iphothi le-TCP noma le-UDP elinenombolo 47. Lomklamo awuvezi i-GRE eluhlaza kunoma iyiphi i-WAN.

Dala ipheya lomhubhe ngama-ID afanayo

Iziphetho zombili zi-interface eyodwa enengqondo echazwe kabili, ngakho inkambu yokuhlonza ngayinye kufanele ihambisane. Ku-habhu:

/interface eoip add name=eoip-lab local-address=10.44.7.1 remote-address=10.44.7.2 tunnel-id=37 mac-address=02:1A:2B:00:00:01

Kurawutha le-LTE amakheli ayaphenduka futhi i-MAC iyahluka:

/interface eoip add name=eoip-lab local-address=10.44.7.2 remote-address=10.44.7.1 tunnel-id=37 mac-address=02:1A:2B:00:00:02

I-ID yomhubhe kufanele ihambisane kuziphetho zombili futhi akumele ingqubuzane nelinye ipheya elivele lilungisiwe kunoma iliphi irawutha. Amakheli e-MAC ayizindinganiso eziphathwa endaweni futhi kufanele ahluke ngaphakathi kwesizinda sesigaba sesibili ojoyina kuso, ngakho ungaphindi usebenzise ivelu elivela esibonelweni somthengisi. Amagama e-interface awendawo kurawutha ngalinye futhi kufanele avumelane kuphela nezincwadi zakho zeqembu.

Incwadi yamanje ye-EoIP ibhala amakhembu okugcina ne-ID yomhubhe futhi isho ngokucacile ukuthi i-EoIP iyi-Ethernet phezu kwe-GRE. Akukho lutho kulo myalo olubethela noma yini, ngakho ukuhlolwa kwesendlalelo esingezansi kuza kuqala.

Bhuloha amaphothi okuhlola kuphela

Ibhuloho yilona elishintsha umhubhe ube yisigaba, futhi ukwakheka kwalo ingqamuzana yonke yokuphepha. Ku-habhu:

/interface bridge add name=br-eoiphub protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:01
/interface bridge port add bridge=br-eoiphub interface=ether7
/interface bridge port add bridge=br-eoiphub interface=eoip-lab

Kurawutha le-LTE:

/interface bridge add name=br-eoiplte protocol-mode=rstp auto-mac=no admin-mac=02:1A:2B:00:01:02
/interface bridge port add bridge=br-eoiplte interface=ether7
/interface bridge port add bridge=br-eoiplte interface=eoip-lab

Le miyalo idala amabhuloho amasha futhi yengeza amaphothi amabili ngqo kwelinye nalinye. I-interface ye-EoIP iyilungu lesigaba sesibili; umhubhe obethelwe uhlala uyizinto zokuhamba ezinomzila futhi akumele ungezwe njengephothi lebhuloho. Ungengezi iphothi lokukhiqiza futhi ungaqali isiphakeli se-DHCP ebhulohweni lelebhu.

Nikeza amahabhu amabili okuhlola amakheli kusubnet engasetshenziswanga ngaphandle kwesiphakeli se-DHCP esincintisanayo, njenge-192.168.77.11/24 ne-192.168.77.12/24. Awadingi isango elimisiwe ukuze afinyelelane ngaphakathi kwaleyo subnet, futhi ikheli le-interface yerawutha alidingeki ukuze amafreyimu adlule.

Hlela izindleko ezengeziwe ngaphambi kokunweba i-LAN

I-EoIP phezu kwe-IPv4 yengeza izihloko ze-Ethernet, i-GRE ne-IP yangaphandle kuzungeza umthwalo othwalwayo. Esimweni esingenathegi i-MikroTik ibhala ama-byte angu-42, ngakho isendlalelo esingezansi esinama-byte angu-1400 e-MTU ye-IP esebenzisekayo sishiya ama-byte angu-1358 efreyimu yangaphakathi. Leyo nombolo yisabelomali hhayi ivelu ye-MSS yomhlaba wonke, futhi ayiphoqi umhambi osebhulohweni ukuthi akhiphe amafreyimu amancane.

Qinisekisa imikhawulo yangempela emzileni, bese uhlola ngefreyimu enkulu kunazo zonke ethunyelwa idivayisi ngempela. Ifreyimu yama-byte angu-1500 okufanele ihlukaniswe ngaphakathi komzila ovikelwe iziphatha ngendlela ehlukile kunaleyo engena, futhi umehluko ubonakala njengokuma kohlelo hhayi njengokwehluleka kwesixhumanisi.

/interface eoip print detail where name=eoip-lab
/interface bridge host print where bridge=br-eoiphub
/ping 192.168.77.12 count=4 interface=br-eoiphub

I-RSTP iphatha amaluphu, hhayi imizila ehambisanayo engahleliwe, ngakho gcina i-topology yokuhlola ilula. Ukunweba ibhuloho kunweba futhi ukuziphatha kokusakaza, i-multicast ne-DHCP emzileni weselula, futhi leyo traffic idla umthamo noma ngabe ikhona ifreyimu ewusizo ehambayo noma cha.

Hlela ukuxhumana kokukhiqiza kuphela lapho ilebhu isifinyelela usayizi wefreyimu nokuziphatha kohlelo okudingayo ngempela. Ngaphambi kwalolo shintsho, vumelana ngekheli, ubulungu be-VLAN, igunya le-DHCP, ukuvimbela amaluphu nokuthi umuntu ufinyelela kanjani kumarawutha uma isixhumanisi ngokwaso sehliwe. Ukunwetshwa kwe-Ethernet kuxhuma izizinda zokwehluleka kanye namadivayisi, ngakho kufanele kuthole iwindi loshintsho hhayi elinye iphothi ebhulohweni elisebenzayo.