Ukuhlela i-IPv6 phakathi kwezindawo ezimbili nge-VPN ekhona

Uma wengeza isijobelelo se-IPv6 kumhubhe wesizinda-kuya-esizindeni, iphakethe alihambeli ngendlela umdwebo osikisela ngayo. I-gateway yasendaweni ithatha lonke iphakethe le-IPv6, iyalibhala ngokuyimfihlo, bese ibeka phambi kwalo isihloko se-IP sangaphandle okuyisigaba sakho sekheli esinqunywa amakheli eziphetho, hhayi lokho okungaphakathi. I-gateway ekude isusa leso sihloko sangaphandle bese idlulisela iphakethe lokuqala ku-LAN yayo, lapho liphinduka iphakethe le-IPv6 elijwayelekile. Umhubhe wangaphandle nokugcwala kwangaphakathi yizingxoxo ezimbili ezihlukene ezabela ukhiye, ipheya leziphetho, futhi akukho okunye.

Izihloko ezimbili, izigaba ezimbili zamakheli

Kumodi yomhubhe ye-IPsec, iphakethe le-IPv6 langaphakathi liba umthwalo ngemuva kwesihloko se-ESP. Isihloko sangaphandle esithwele lelo phakethe le-ESP singaba i-IPv4 noma i-IPv6, futhi silandela local_addrs ne-remote_addrs. I-WireGuard yenza okufanayo ngomkhosi omncane: iphakethe langaphakathi umthwalo we-datagram ye-UDP eya esiphethweni somlingani. Womabili ashiyi isihloko sangaphakathi singathintekile, yingakho indawo ekude ingasihlela ngemuva kokuvula.

Indlela phakathi kwezindawo ibona kuphela i-UDP 4500 uma i-IPsec isebenzisa i-NAT traversal, noma i-UDP 51820 kumlaleli we-WireGuard ojwayelekile. Noma yimuphi umhleli wendlela angaba yi-IPv4 kuphela futhi ukugcwala kwe-IPv6 kuyawela noma kunjalo, ngoba akukaze kuvele njengephakethe le-IPv6 kuleyo ndlela. Lokho kunika ukuhlukaniswa kokuqala okucacile: tcpdump -ni eth0 udp port 51820 ukhombisa indlela efihliwe, tcpdump -ni wg0 ip6 ukhombisa ukugcwala kwangaphakathi. Ukuthwebula kwangaphandle okumatasa nokwangaphakathi okuthulile kusho ukuthi i-kernel ayifaki i-IPv6 emhubheni; lokho ukuhlela noma inqubomgomo, hhayi isimo sesixhumanisi.

I-gateway futhi yehlisa i-Hop Limit yangaphakathi uma idlulisa, ngakho iziphetho zibalwa njengabahleli endleleni ye-IPv6. Inani lamahopu angaphandle ne-Hop Limit yangaphakathi zihamba ngokuzimela, futhi iphakethe elifa ku-gateway ekude lifa ekudluliseni, hhayi ekubhaleni ngokuyimfihlo.

Izikhethi ne-AllowedIPs uhlu lwemvume

I-IKEv2 ixoxisana ukuthi yiziphi izijobelelo zangaphakathi i-child SA engazithwala. Ku-strongSwan 5.9 nangemuva, ukuzibhala ku-swanctl.conf kubukeka kanje:

children {
  net6 {
    local_ts  = 2001:db8:aa::/48
    remote_ts = 2001:db8:bb::/48
    mode = tunnel
    esp_proposals = aes256gcm16-prfsha384-ecp384
    start_action = trap
  }
}

Shiya i-local_ts ne-remote_ts bese i-strongSwan izithola kumasubnethi e-interface eyikhethayo. Kusihambi se-dual-stack leyo ndlela emfushane ivamise ukuveza ipheya le-IPv4 kuphela: i-SA inyuka futhi i-IPv6 iyanqanywa ngaphambi kokufika kukhodi ye-ESP. Ukubhala zombili izijobelelo kwenza i-SA ikwazi ukuzithwala, futhi i-start_action = trap iyikhuphula kupakethe lokuqala elifanayo.

I-WireGuard inohlu olulodwa olwenza imisebenzi emibili. Kubhloko yomlingani, i-AllowedIPs = 2001:db8:bb::/48, fd00:bb::/48 iyimizila efakwa ekuthumeleni kanye nesihlungi esisetshenziswa ekwamukeleni: iphakethe elivuliwe umsuka walo wangaphakathi ophuma ngaphandle kohlu lwalowo mlingani lilahliwe ngokuthula. I-wg-quick ingeza umzila kwikhono ngalinye, ngakho ibhloko yomlingani engezansi ayidingi umyalo we-ip -6 route ohlukile.

[Interface]
Address = 2001:db8:aa:ff::1/64, fd00:aa:ff::1/64
ListenPort = 51820

[Peer]
PublicKey = <site-b-public-key>
Endpoint = 203.0.113.20:51820
AllowedIPs = 2001:db8:bb::/48, fd00:bb::/48

Womabili amahlu kufanele abe ngokulinganayo: isizinda B samukela isijobelelo sesizinda A njengesikhethi esikude futhi sisihlela sibuyele, futhi umhubhe usebenza kuphela uma izinhlangothi ezimbili zivumelana. Uhlu olungalingani lunikeza uphawu oludla isikhathi esiningi — i-handshake enempilo, izibali ezihamba ngakolunye uhlangothi, futhi i-ping esuka ku-A iya ku-B ephumelelayo ngenkathi kukhona okusuka ku-B okufika ku-A.

Ukudlulisa, imizila kanye nesijobelelo sokubuya

I-Linux ayidlulisi i-IPv6 kuze kube yilapho usho, futhi isilungiselelo singesasekhaya hhayi se-interface:

sysctl -w net.ipv6.conf.all.forwarding=1
ip -6 route add 2001:db8:bb::/48 dev wg0
ip -6 route get 2001:db8:bb::10 from 2001:db8:aa::10

Umgqa wesibili yilo olukhohlwa emiklamweni esekelwe emizileni. I-IPsec esekelwe kwinqubomgomo ifaka inqubomgomo ye-XFRM ehambisana nezijobelelo, kodwa ukuhlelwa okusekelwe emizileni ne-vti6 noma i-WireGuard kudinga umzila wangempela we-IPv6 okhomba kuleyo divayisi. Gcina i-sysctl ngaphansi kwe-/etc/sysctl.d/; uma kungenjalo ukuqamba kabusha kubuyisela ukudlulisa kokuthulile kokucishiwe.

Ukudlulisa kunomphumela wesibili okufanele waziwe: i-kernel ibe isiyishaya indiva imikhangiso yomhleli ngaphandle uma i-net.ipv6.conf.<wan>.accept_ra iyi-2, ngakho i-gateway okufika kuyo ikheli le-WAN nge-SLAAC ingalahlekelwa umzila wayo ojwayelekile ngaso leso sikhathi uma uvula ukudlulisa. Setha i-accept_ra = 2 kuleyo interface efayilini elifanayo futhi umzila uyaqhubeka ukhona. Ingqikithi yesizinda B kufanele futhi ifunde i-2001:db8:aa::/48 kusuka ku-gateway yomhubhe, ngomzila oqinile noma ngeprotokholi yokuhlela phezu komhubhe, uma kungenjalo impendulo ifela ngaphakathi kwenethiwekhi ka-B uqobo.

Ukuhlola kwezinyathelo ezine okubonisa lapho ukwephuka

Sebenza ngalolo kuhlelo futhi ume esinyathelweni sokuqala esihlulekayo, ngoba isinyathelo ngasinye esilandelayo sincike kwezandulelayo.

1. Izikhethi: i-swanctl --list-sas kufanele ikhombise ipheya lezijobelelo ze-IPv6 ku-child SA, noma i-wg show wg0 allowed-ips isijobelelo esikude nge-latest-handshakes yakamuva.
2. Umzila we-kernel: i-ip -6 route get 2001:db8:bb::10 kufanele iphendule ngedivayisi yomhubhe, hhayi i-interface ye-WAN.
3. Ukuthwebula kwangaphakathi: i-tcpdump -ni wg0 ip6 ngenkathi uphinga phakathi kwamahambi wangempela e-LAN. Amaphakethe aphumayo kodwa awekho abuyayo akhomba umzila noma i-firewall ka-B; awekho amaphakethe ngokuphelele akhomba emuva esinyathelweni 1 noma 2.
4. Indawo: kusihambi B, i-ss -6 -ltn iqinisekisa ukuthi insizakalo ilalela ku-IPv6, futhi izibali zasekhaya ze-firewall zikhombisa ukuthi iphakethe lamukelwe noma lahliwe.

I-MTU ingena esigabeni esifanayo. Abahleli be-IPv6 abahlukanisi, ngakho iphakethe elikhulu kakhulu liyalahlwa futhi i-Packet Too Big ibuyela kumthumeli. Uma ama-handshake nama-ping amancane esebenza kodwa ukudluliswa kwefayela kuyama, nciphisa umthwalo kuze kudlule: ping -6 -s 1400 -c 3 2001:db8:bb::10. Ama-interface e-WireGuard ane-MTU eyi-1420 byte ngokujwayelekile futhi i-IPsec phezu kwe-IPv4 inciphisa okuningi, ngakho ukusetha i-MTU yangaphakathi kungcono kunokuthemba ukutholwa kwe-MTU yendlela ngokusebenzisa i-firewall elahla i-ICMPv6.

Izimo zokwehluleka ezibukeka njengezinkinga ze-firewall

Evame kakhulu akuyona i-firewall nhlobo: insizakalo ihlanganisa ku-0.0.0.0 esikhundleni se-::, irekhodi le-AAAA likhona, futhi iklayenti ithola ukwenqanywa okusheshayo nge-IPv6 okufihlwa isiphequluli se-dual-stack ngokubuyela ku-IPv4. Uma izinhlelo ezithile kuphela zehluleka, hlola isigaba esilalelayo ngaphambi kokuthinta isethi yemithetho.

Eyesibili ukuhlungwa kwe-ICMPv6. I-Neighbor Discovery ne-Packet Too Big ziyingxenye yokusebenza okujwayelekile, hhayi ukuxilonga, futhi inqubomgomo elahla yonke i-ICMPv6 ikhiqiza umhubhe oxhumana, uqinisekise, bese uyama kunoma yini enkulu kunephakethe elincane. Vumela izinhlobo okuncike kuzo umzila futhi ushiye izibali zivuliwe ukuze ukulahla kubonakale.

Eyesithathu isijobelelo esingeziwe emhubheni kodwa esingakaze sengezwe ohlelweni lwamakheli lwesizinda esisiphethe, ngakho akekho umhleli oyisimemezelayo futhi akekho umhambi ongaphendula kusuka kuso. Qala ngesijobelelo esisodwa nepheda elilodwa lamahambi, qinisekisa izinhlangothi zombili ngezinyathelo ezine, bese wengeza okunye; isijobelelo esiphukile sihlala siline elilodwa ekumisweni esikhundleni sokuhlelwa kabusha. Okuwukuphela kwereferensi esemthethweni okufanele kugcinwe kuvulekile RFC 8200, echaza isihloko esithwalwa umhubhe.