I-IPv6 egress iyafa ngemva kokuvuselelwa kwe-OpenVPN: hlola ukuthi i-prefix ingeyakabani
I-IPv6 iyafa ngemva kokuba umhubhe udalwe kabusha. Nquma ukuthi ubani umnikazi we-prefix edlulisiwe, amakheli amaklayenti kanye nomzila wokubuya ngaphambi kokuvuselela noma yini.
I-IPv6 iyeka ukudlulisa ithrafikhi ngaso leso sikhathi lapho OpenVPN ivuselelwa khona, kuyilapho i-IPv4 iqhubeka nokusebenza. I-interface yomhubhe yadalwa kabusha, futhi enye into eyayilawula isimo sayo se-IPv6 yalahlekelwa ikheli noma umzila owenza i-prefix ifinyeleleke. Kunezingxenye ezintathu ezihlukene zesimo ezihilelekile, futhi ngayinye inomnikazi ohlukile: i-prefix edlulisiwe yomhlinzeki kanye nempilo yayo, amakheli anikezwa amaklayenti e-VPN, kanye nomzila waphezulu obuyisela leyoprefix yeklayenti kuseva. Khomba umnikazi wengxenye ngayinye ngaphambi kokuthinta noma iyiphi i-daemon, ngoba ukuvuselela okungalungile kufihla inkinga usuku bese kuyibuyisela ekuxhumaneni okulandelayo.
Izingxenye ezintathu zesimo se-IPv6, abanikazi abathathu
| State | Typical owner | What breaks when it is wrong |
|---|---|---|
| Delegated prefix and lifetime | Upstream router or provider via DHCPv6-PD | Clients keep addresses that the upstream no longer routes |
| Client addresses inside the tunnel | OpenVPN server config or a delegation daemon | No global address, or an address outside the routed prefix |
| Return route for the client prefix | Upstream router, or the server's own routing table | Outbound works, replies never arrive |
Ikheli elinomkhawulo womhlaba wonke ngaphakathi komhubhe alanele lodwa. Amaroutha aphezulu kusamele athumele leyo prefix ibuyela kuseva ye-VPN, futhi ngeke akwenze lokho ngoba nje iseva inekheli elivela kuyo ngengozi.
Yingakho nokukopisha i-/64 yomphakathi echibini lomhubhe kuyingozi. I-prefix eqondiswe kuseva ayifani ne-prefix abakubheka phezulu njenge-on-link, futhi ukutholakala komakhelwane ngeke kugcwalise leso sikhala.
Funda isimo seseva ngaphambi kokushintsha noma yini
Thwebula isimo kabili, kanye ngesikhathi i-IPv6 isebenza futhi kanye ngemva kokuvuselelwa, bese uqhathanisa. Ukubukwa kokufunda kuphela kwanele, futhi akubizi lutho ngesikhathi sewindi lokulungisa:
ip -6 addr show
ip -6 route show table all
ip -6 rule show
sysctl net.ipv6.conf.all.forwardingFuna umehluko othile emithathu: umzila owanyamalala, ikheli elidlulele empilweni ephelelwe yisikhathi noma engavumelekile, kanye ne-prefix eyashintsha ngemva kokudluliselwa kabusha kuyilapho ukulungiselelwa kwe-VPN kusamemezela okudala.
Uma ikheli lanyamalala kodwa i-prefix ayishintshanga, i-daemon eyabelayo iyeke ukuphatha i-interface. Uma i-prefix yashintsha kodwa amakheli angashintshanga, ukulungiselelwa kweklayenti sekuphelelwe yisikhathi. Kokubili ukwehluleka kubonakala kufana esipheqululini futhi akukho okufanayo phakathi kwazo.
Nquma ukuthi i-dhcpcd kufanele iphathe umhubhe yini
I-dhcpcd ingathola ama-interface futhi idlulisele izingxenye ze-prefix ye-DHCPv6 kuma-interface aphansi, futhi ukulungiselelwa kwayo kungasho ngokusobala izinhloso zokudlulisela. Ngaphandle kwenhloso esobala, ukuziphatha kwayo okubhaliwe kungabandakanya ezinye izinethiwekhi, futhi yileyo ndlela umhubhe uthola ikheli okungekho muntu owayelihlelela.
Izimo ezimbili kufanele zikusukumele ekutheni uvumele i-OpenVPN ukuba ibe ngumnikazi wamakheli amile omhubhe: iseva igxusha amakheli angenakushintshwa ekulungiseleleni kwayo, futhi igama lomhubhe liyashintsha ekuxhumaneni kabusha. Uma kokubili kuyiqiniso, khipha umhubhe ku-daemon yokudlulisela ngamabomu, nencazelo esho isizathu.
Uma ngakolunye uhlangothi ukudlulisela emhubheni kwenziwa ngamabomu, sebenzisa ukuphathwa kokushintsha kwe-prefix. Lokho kusho ukusabela lapho i-prefix edlulisiwe noma impilo yayo ishintsha, ukubuyekeza i-prefix yeklayenti emenyezelwa yiseva, nokwengeza umzila futhi. Ukukhipha i-interface kuleso sakhiwo kususa ingxenye eyodwa kuphela eyazi nge-prefix entsha.
Ukuvuselela i-dhcpcd kungabonakala kulungisa izinto ngoba kudala isimo kabusha, kodwa futhi kuvuselela noma kuhoxisa ukulungiselelwa kwama-interface obungawacabangi. Lokho kubuyisela akukwenzi kube yisibopho ngemva kokuvuselela kwe-VPN ngakunye. Kubuye kusethe kabusha izibali obuzisebenzisa njengobufakazi. Khetha ukulayishwa kabusha okubhekiswe ku-interface oyishintshe ngempela.
Qinisekisa i-IPv6 ngokwehlukile ku-NAT ye-IPv4
Qinisekisa ukuthi ukudlulisela kuvuliwe nokuthi umzila waphezulu ukhomba ku-prefix yeklayenti yangempela, bese wenza ukuxhumana okusha kwe-IPv6 okuvunyelwe. Hlola futhi ithebula lemizila ye-IPv6 yeklayenti ngokwalo, ngoba iklayenti elibonisa ikheli lomphakathi alifakazeli ukuthi isicelo salo sisebenzise umhubhe.
Ukufihla kwe-IPv4 kuxazulula enye inkinga: umzila wokubuya wemithombo yangasese. Akuwenzi lutho ku-prefix ye-IPv6 ehoxisiwe, futhi ukwengezwa kwayo ngeke kubuyisele i-IPv6.
Qeda ngerekhodi lobunikazi: iyiphi ingxenye edlulisela i-prefix, eyiphi eyabela amakheli eklayenti, eyiphi ephethe umzila wokubuya, nokuthi kwenzekani kungxenye ngayinye ekuxhumaneni kabusha. Imigqa emine ku-runbook isindisa umuntu olandelayo ekuvuseleleni ama-daemon amathathu ukuze athole eyayibalulekile.