I-IPv6 link-local ayisebenzi nge-VPN: kungani i-fe80 ima kuxhumanisi
Ikheli le-fe80:: linencazelo kuxhumanisi olulodwa kuphela. Bona ukuthi kungani i-VPN ehambiswayo ingakwazi ukulithwala, ukuthi ukwehluleka kubonakala kanjani, nokuthi yiliphi ikheli okufanele ulisebenzise esikhundleni salo.
Ukhulisa umhubhe, uphinga i-fe80::1 usebenzisa umhubhe njenge-interface yomthombo, futhi akukho lutho olubuyayo. Lona akulona umthetho we-firewall oyikhohliwe. Ikheli le-link-local linencazelo kuphela kuxhumanisi olulodwa lapho lakheka khona, futhi i-VPN ehambiswayo ayilona lolo xhumanisi. I-fe80::1 yerutha ekude isegmeni ye-LAN ekude; wena usegxathini elilodwa kude kusegimenti enye, futhi i-IPv6 ayinayo indlela yokuthi irutha idlulise amaphakethe e-link-local nhlobo.
Isiqalo se-fe80 sichaza ububanzi, hhayi ibanga
I-link-local unicast yi-fe80::/10, futhi isici esiyichazayo akusona inombolo kodwa ububanzi. Ikheli lisebenza kuphela kuxhumanisi olulodwa, futhi yonke i-interface yakha elilodwa kusuka kusihlonzi sayo, yingakho imishini emibili engahlobene kumaxhumano amabili angahlobene ingaphendula yomibili ku-fe80::1 ngaphandle kokungqubuzana okuncane. Isiqalo sisho ukuthi “kuxhumanisi othile”; uxhumanisi ngokwalo luza kumongo.
Kusihloko, lowo mongo yisifunda, noma i-scope ID, oyengeza ngemva kophawu lwephesenti: fe80::1%eth0 ku-Linux, fe80::1%3 noma fe80::1%12 ku-Windows nasezinsizeni ezibonisa izinkomba ze-interface. I-kernel ixazulula ikheli kanye nenkomba ye-interface bese ithumela. Uma ususa isifunda, indawo ekuyiwa kuyo iyadideka, ngakho isitaki asinayo indlela yokukhetha isegimenti.
Kungani umhubhe ohambiswayo ungakwazi ukuliletha
I-VPN ehambiswayo i-interface ye-point-to-point ethwala amakheli ayo, ngokuvamile i-/64 yesikhala se-IPv6 esiyi-unique-local noma esiyimfihlo ngaphakathi komhubhe. I-LAN ekude iyixhumanisi elihlukile, elifinyelelwa ukuphela komhubhe okuhambisa futhi kudlulise egameni lakho. Lezi zingamasegmenti amabili ahlukene, ngakho ikheli elisuka kwelinye aliyona indawo efanele kwelinye.
Umthetho wokudlulisa ukhulunyiwe kumbhalo wobuchwepheshe, akuyona inkani yeklayenti lakho: amarutha awadlulisi amaphakethe anomthombo noma indawo ekuyiwa kuyo ye-link-local. Yingakho iphakethe lifa ngisho noma ithebula lerutha libonakala lilungile. Engeza indlela ye-fe80::/64 ebheke emhubheni futhi isitaki esihambisana nomthetho sizoyenqaba noma siyemukele bese silahla wonke iphakethe elihambisanayo: ububanzi bendawo ekuyiwa kuyo buthi “lolu xhumanisi kuphela”, futhi i-interface ephumayo ayilona lolo xhumanisi.
Ukutholakala komakhelwane kuqinisa lowo mkhawulo. Izihloko zixazulula amagxathu alandelayo e-link-local ngesicelo sikamakhelwane esithunyelwa ku-multicast yobubanzi buxhumanisi ngomkhawulo wamagxathu angu-255, ngakho amarutha angalahla noma yini edlulisiwe. Ukukwenza kusebenze emhubheni kungasho ukuxhumanisa ukutholakala kwesegimenti esikude, okuyibhuloho le-Layer 2 elinezigqoko ezihlukile.
Kukhona ukwehluleka kwesibili okuthule kakhulu, futhi kubamba abantu abasazama ukuphoqelela indlela: isifunda. Noma yisiphi isifunda osibhalayo endaweni sisho i-interface yomhubhe, kanti ikheli olifunayo liboshwe ku-interface ye-LAN ekude. Kokubili akukaze kuhambisane, ngakho iphakethe alikwazi ukuqondiswa ku-interface efanele ekugcineni okude.
Ukwehluleka kubonakala kanjani empilweni
Umkhiqizo wensiza wephutha lobubanzi ufunda njengephutha lokuhambisa noma le-firewall, futhi yingakho abantu bechitha ingxenye yosuku esigabeni esingalungile.
| What you run | What you see | What it means |
|---|---|---|
| ping fe80::1 with no zone | Invalid argument on Linux, or a transmit failure on Windows | The stack cannot pick an interface for an ambiguous destination |
| ping -6 -I tun0 fe80::1 | Destination unreachable, or a silent timeout | The address is not on the tunnel link, so there is nothing on-link to answer |
| ssh user@fe80::1 after the tunnel is up | Hangs, then no route to host | The SYN never left the machine in a deliverable form; the server logs nothing |
| ip -6 neigh show dev tun0 | Empty table | No neighbor entry can exist for a link-local host that is not on this link |
| fe80::/64 inside AllowedIPs or route-ipv6 | Config accepted, traffic still dropped | The tunnel carried the packet; the receiving stack refused to forward it |
Umugqa wesithathu uchitha isikhathi esiningi, ngoba iklayenti le-ssh elingenakho okukhiphayo libukeka njengenkinga yensiza elalelayo. Uma unayo indlela yokungena, hlola uhlangothi olukude futhi uqinisekise ukuthi i-sshd iboshwe kuwo wonke amakheli noma kwelilodwa kuphela.
Sebenzisa ikheli elenzelwe ukuhambiswa
Kukho konke okudinga ukufinyelela ngomhubhe, sebenzisa ikheli insiza eyanikezwa lona ngale njongo: ikheli le-unicast lomhlaba wonke, noma ikheli le-unique-local elivela ku-fc00::/7, ibanga eligcinelwe leli cala langaphakathi. Qinisekisa ukuthi isilaleli silibopha ngempela, futhi hlola indlela yokubuya kanye nanoma yimuphi umthetho we-firewall womsingathi.
Buka umsingathi okude esikhundleni sokuqagela. I-ip -6 addr show ibala amakheli akhona, futhi i-ss -6 -ltn ibala lokho i-daemon ekulalelayo. Insiza eboshwe ku-fe80:: kuphela ifinyeleleka kuphela kusegimenti yayo, okuvame ukuba yisimo esizenzakalelayo okungekho muntu owakhetha ngamabomu futhi esingashintshwa ngemvume yomlawuli.
Uma insiza ingenakuboshwa kabusha ngempela, phakamisa ibhuloho siye esigabeni sohlelo esikhundleni sesigaba senethiwekhi. I-relay kumsingathi okude elalela ikheli elihambisekayo futhi exhuma kulelo le-link-local ixazulula inkinga ngaphandle kokunweba noma yisiphi isegimenti:
socat TCP6-LISTEN:8080,bind=[fd00:1:2::10] TCP6:[fe80::1%eth0]:80Lapha isifunda sisehlangothini olufanele, kumsingathi ono-eth0 ngempela kulolo xhumanisi. Iklayenti lakho likhuluma ne-fd00:1:2::10, ehambiswa ngendlela evamile, futhi i-relay yenza igxathu le-link-local endaweni. Iqhinga elifanayo lisebenza ku-UI yewebhu yedivayisi noma i-BMC endala ememezela ikheli le-link-local kuphela.
Uma ukubhuloha kuyimpendulo ngempela, nokuthi yini okufanele ihlolwe
Ezinye izinto zokusetshenziswa zidinga ngempela isegimenti esisodwa esabiwe: idivayisi ekhuluma kuphela ngokutholakala kwe-link-local, ithuluzi elincike ku-multicast, ilabhorethri ekhiqiza kabusha i-LAN eyisicaba. Le nkinga ye-Layer 2 futhi idinga impendulo ye-Layer 2, njengedivayisi ye-tap ebhulohwe ku-interface ekude noma umkhiqizo weklayenti onemodi yebhuloho ecacile. Lokhu kukubiza ithrafikhi ye-broadcast ne-multicast ewela umhubhe kanye nokutholakala komakhelwane okufanele kusebenze kusukela ekupheleni kuya ekupheleni.
Ungasondeli kulokhu ngokwengeza i-fe80::/64 kuphrofayela ehambiswayo. Lokho kukhiqiza isimo esibi kakhulu: ukucushwa kubonakala kuphelile, ithebula lerutha likhombisa okufakiwe, futhi wonke iphakethe lisalahlwa endaweni ethile phakathi kwezitaki ezimbili ezombili eziziphatha kahle.
Qinisekisa nge-interface hhayi nge-ping. I-ip -6 addr show tun0 ikutshela ukuthi uxhumanisi lomhubhe lwakhe ikheli lalo le-link-local, futhi i-ip -6 route get fe80::1%tun0 ikutshela ukuthi i-kernel ingenzani ngempela ngendawo enobubanzi. Uma i-kernel ithi indawo ekuyiwa kuyo ayifinyeleleki kuleyo interface, akukho sethi yomhubhe ezokushintsha, futhi sekuyisikhathi sokuyeka ukuhlela iphrofayela.
Ukulandelana okufushane okuqeda umbuzo:
- Funda ikheli kumsingathi okude futhi uphawule ukuthi yi-fe80:: noma isiqalo esihambisekayo.
- Uma kuyi-fe80::, bopha kabusha insiza, yenza i-relay kulo mosingathi, noma bhuloha isegimenti; uma kuhambiseka, lungisa indlela, i-firewall noma ikheli lokubopha.
- Hlola isifunda kabusha njalo uma uphinda uhlole, ngoba umyalo okopishiwe uvame ukugcina i-interface engalungile.
Imithombo: RFC 4291, isakhiwo samakheli e-IPv6.