Indlela ezimisiwe ye-IPv6 yanyamalala ngemva kokunika amandla ukudlulisa ku-Linux

Ngabeka net.ipv6.conf.all.forwarding=1 esangweni le-Debian ukuze likwazi ukudlulisa ithrafikhi yamaklayenti e-VPN, futhi cishe ngemva kwesigamu sehora umshini wawungasenayo indlela ezimisiwe ye-IPv6. I-router ephezulu yayisebenza, umakhelwane we-link-local wayesaphendula, futhi i-uplink yayisabambe ikheli layo lomhlaba. Okwayeka kwaba ukuzimisela kwe-kernel ukuqhubeka nokwamukela ama-router advertisements kuleyo interface. Indlela ayizange inyamalale lapho ngibhala i-sysctl; yanyamalala lapho isikhathi sokuphila sendlela ezimisiwe efundwe ku-RA siphela futhi kungekho okwayivuselela.

Ekuqaleni kwakungekho okwabonakala kuphukile. Ukudlulisa kwakusebenza, amaklayenti ayesadlula ngesikhathi indlela endala isesikhashini, futhi ukwehluleka kwafika ngemva kwesikhathi eside kunoshintsho olwadalayo. Yilokho kubambezeleka okuyisizathu sokuthi lokhu kuthweswe icala ku-uplink noma kumthetho we-firewall owawungakaze ube yingxenye.

Funda ithebula lezindlela ngaphambi kokuthinta noma iyiphi i-sysctl

Qala nge-ip -6 route show default futhi ufunde izimfanelo, hhayi isango kuphela. Indlela ezimisiwe efundwe ku-RA imakwe nge-proto ra, ithwala ukuthandwa futhi ibonisa ukubalwa phansi kwe-expires. Indlela oyengeze ngomhlathi ayinakho kukodwa kwalokho, futhi lowo umehluko ukutshela ukuthi iyiphi indlela isebenza ngayo.

$ ip -6 route show default
default via fe80::1 dev eth0 proto ra metric 1024 expires 1432sec hoplimit 64 pref medium

Bese ubheka ikheli: ip -6 addr show dev eth0. Ikheli lomhlaba elinezikhathi zokuphila ezithandwayo nezivumelekile ezilinganiswa ngamahora lizophila isikhathi eside kunendlela ezimisiwe enesikhathi sokuphila se-router esilinganiswa ngamaminithi. Ikheli likhona kodwa indlela ezimisiwe ayikho, lokho kuwuphawu lwenkinga yezimemezelo. Uma nekheli lingekho, kufanele kuqale ukulandela isixhumanisi, ulwazi lwephrefikisi noma ukutholwa kwamakheli aphindwe kabili.

Kungani ukudlulisa kucisha ukucutshungulwa kwe-RA

I-RA iphakethe le-ICMPv6 lohlobo 134, elithunyelwa lisuka kumthombo we-link-local elinomkhawulo wokugxuma ongu-255. Ngaphambi kokuthi i-kernel ilisebenzise, ibheka i-accept_ra yesikhombisi. Inani elizimisiwe lingu-1, futhi u-1 akusho ukuthi yebo. Kusho ukuthi: amukela kuphela ngesikhathi le-host ingadlulisi. Beka i-forwarding=1 futhi leso simo siyahluleka, ngakho isimemezelo siyalahlwa ngaphambi kokuthi kucatshangelwe noma iyiphi iphrefikisi noma i-router ezimisiwe elikuyo.

Kunamanani amathathu, futhi uhlobo lwesithathu kuphela olusinda ekudluliseni:

Amanye amafulegi amabili anquma ukuthi yini efakwa ngempela. I-accept_ra_defrtr ilawula ukuthi i-router ezimisiwe esimemezelweni iba indlela yini, futhi i-accept_ra_pinfo ilawula ukuthi ulwazi lwephrefikisi lusetshenziselwa ukumiswa kwekheli yini. Ukucisha i-accept_ra_defrtr kuyindlela evamile yokugcina amakheli e-SLAAC ku-host edlulisayo ngaphandle kokufunda indlela ezimisiwe. Kuyisigxobo esihlukile kune-accept_ra, futhi yiso esisetshenziswa uma ufuna amakheli kodwa hhayi indlela. Incwadi yereferensi ye-kernel ye-IP sysctl ibala zontathu.

Qinisekisa ngemiyalo emithathu

Okokuqala, funda amanani asebenzayo esikhundleni sefayela ocabanga ukuthi lilayishiwe:

sysctl net.ipv6.conf.eth0.forwarding net.ipv6.conf.all.forwarding \
       net.ipv6.conf.eth0.accept_ra net.ipv6.conf.eth0.accept_ra_defrtr

Okwesibili, fakazela ukuthi izimemezelo zisafika. Ukuhlunga ngebhayithi yohlobo lwe-ICMPv6 kwanele, futhi kukusindisa ekufundeni udonga lwethrafikhi yokutholwa komakhelwane:

tcpdump -ni eth0 'icmp6 and ip6[40] == 134'

Uma kungaveli lutho phakathi namaminithi ambalwa, i-accept_ra akuyona inkinga yakho. Uhlangothi oluphezulu luyeke ukumemezela, okuthile endleleni kuhlunga i-ICMPv6, noma leso sikhombisi asikho ngempela esigabeni osicabangayo. Okwesithathu, cela isimemezelo ngokwakho futhi ufunde izinkambu zaso:

rdisc6 eth0

I-rdisc6 iza kuphekhethe le-ndisc6 ku-Debian naku-Ubuntu. Kokukhishwayo, bheka isikhathi sokuphila se-router nokuthandwa ngaphambi kokushintsha enye into. Isimemezelo esinesikhathi sokuphila se-router esingu-0 siyileyalo yokususa i-router ezimisiwe, futhi akukho nani le-accept_ra elikwenza kube indlela esebenzisekayo. Yile ndlela futhi obamba ngayo i-CPE yaphezulu esemodini yebhuloho edlulisela amaphrefikisi kodwa engazange izinikele njenge-router.

Yenza i-uplink ibe isikhombisi esisodwa esivumelayo

Uma uhlangothi oluphezulu kufanele lube i-router ezimisiwe, yamukela izimemezelo lapho naphezu kokudlulisa, futhi kungenjalo kwenye indawo:

# /etc/sysctl.d/60-ipv6-router.conf
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.eth0.accept_ra = 2
net.ipv6.conf.eth0.accept_ra_defrtr = 1

Ukukhawulela kubalulekile ngoba ukudlulisa kwe-IPv6 ku-Linux kuyiswishi eyodwa yomhlaba, hhayi eyodwa ngesixhumanisi ngasinye. Bhala u-1 ku-net.ipv6.conf.wg0.forwarding bese ufunda i-net.ipv6.conf.all.forwarding: inani lomhlaba liyaphenduka futhi sonke isikhombisi siqala ukudlulisa. Awukwazi ukuba yi-router emhubheni futhi ube yi-host evamile ku-LAN. Ongakukhawulela ukwamukela. Gcina i-accept_ra=2 ku-uplink futhi ushiye izikhombisi zomhubhe neze-LAN ku-1 noma ku-0, ukuze isimemezelo esilahlekile esifika ngomhubhe singakwazi ukufaka indlela ezimisiwe ekhomba kuwo.

I-sysctl -w yesikhashana ngeke isinde ekuqaliseni okulandelayo, futhi kokubili i-systemd-networkd ne-NetworkManager zibhala lawa manani zisuka ekulungiselelweni kwazo. Ku-networkd, beka i-IPv6Forwarding=yes ne-IPv6AcceptRA=yes efayeleni le-.network le-uplink; i-networkd ichaza i-IPv6Forwarding njengomhlaba ngesizathu esifanayo se-kernel. Ku-NetworkManager, i-ipv6.method=auto ku-uplink yiyo eqhuba inani le-accept_ra, ngakho funda kabusha i-sysctl ngemva kwe-nmcli connection up esikhundleni sokuthemba ukuhlola kokuqala.

Enye indlela engashintshi, i-ip -6 route add default via fe80::1 dev eth0, iyasebenza ngempela, futhi iyimpendulo enengqondo uma i-router yaphezulu inekheli le-link-local elizinzile. Yazi kahle okushiyayo. Indlela ezimisiwe engashintshi ayikaze ivuselelwe futhi ayikaze ihoxiswe, ngakho iyaqhubeka nokukhomba kumakhelwane ofile ngemva kokuba uhlangothi oluphezulu lushintshiwe. Indlela ye-RA yehluleka ngokuphephile; leyo engashintshi yehluleka buthule.

Hlola iphakethe elidlulisiwe, hhayi elikasango uqobo

Ama-ping kasango uqobo angaphumelela endleleni okungekho klayenti elingayisebenzisa, futhi angaphumelela ngenxa yokuthi isango lingumthombo. Hlola kuklayenti elixhunyiwe, bese ubuza isango ukuthi lenzeni ngekheli lalelo klayenti:

# on the VPN client
ping -6 -c 3 2001:4860:4860::8888

# on the gateway, using a client address
ip -6 route get 2001:4860:4860::8888 from fd42:20::2

Bese ulinda isikhathi sokuphila se-router esisodwa futhi ubheke futhi. Isimo esizinzile osifunayo yindlela ezimisiwe emakwe nge-proto ra enenani le-expires elihlala lisethwa kabusha, kanye ne-all.forwarding=1. Uma i-expires ibala phansi kuphela, izimemezelo zisalahlwa kwenye indawo, futhi okuvame ukuba yimbangela umphathi wenethiwekhi obhala kabusha i-accept_ra ngemva kokuba i-sysctl yesikhathi sokuqalisa isivele yasebenza.

Ngaphambi kokuvala lokhu, qinisekisa izinto ezine: indlela ezimisiwe i-proto ra futhi iyavuselelwa, i-accept_ra=2 isebenza ku-uplink kuphela, ukudlulisa kusengu-1 ngemva kokuqalisa kabusha nangemva kokuqalisa kabusha umphathi, futhi uklayenti, hhayi isango, oqedayo i-ping ye-IPv6. Uma iklayenti lisahluleka nendlela enempilo, umsolwa olandelayo yindlela yokubuya noma i-firewall yaphezulu, hhayi isimemezelo.