Ukuhlelwa kwemigudu ye-IPv6 lapho ama-uplink amabili abelana nge-fe80::1

Unama-uplink amabili, futhi ip -6 route show iphrinta ihop elandelayo efanayo kuwo womabili: default via fe80::1 dev uplink0 futhi default via fe80::1 dev uplink1. Lokhu akukona ukungqubuzana kwekheli eliphindwe kabili, futhi ukukopisha ihop elandelayo elingenalutho fe80::1 ethebuleni lomgomo akutsheli i-kernel ukuthi wawusho muphi umliki. Umbuzo wangempela mncane kunalokho okusikiselwa uphawu: ingabe ithebula lesibili lidinga umliki owodwa noma womabili, futhi yini egcina leyo mizila iphila ngemuva kokuqalisa kabusha. Izimo ezintathu, ezihlolwa ngokulandelana, zixazulula okuningi.

I-fe80::1 efanayo ingomakhelwane ababili abehlukene

Amakheli asendaweni yomliki anomkhawulo kumliki owodwa, ngakho fe80::1 akulona ikheli elilodwa eliphrintwe kabili; ingomakhelwane ababili ababelana ngesijobelelo esifanayo ngengozi. Inkomba yesifunda iyindlela i-host esho ngayo ukuthi iyiphi efunayo, ngakho fe80::1%uplink0 futhi fe80::1%uplink1 izindawo ezihlukene ze-kernel, futhi leso sijobelelo asiyi noma nini kumzila wokuxhumana okude. RFC 4007 ichaza imodeli yesifunda engemuva kwalokhu, futhi yingakho ithebula lomgomo kufanele liphathe idivayisi kanye nayo yonke ihop elandelayo yasendaweni yomliki.

Umakhi wokuhlela we-VPN okopisha i-ID yesifunda yezinombolo esuka ku-host eyodwa ayifake kuthempulethi ubheka umongo wasendaweni njengengxenye yekheli, futhi ifayela alibhalayo alilungile kuwo wonke umshini onamagama noma izinkomba ze-interface ezihlukene. Ithebula lomgomo alihlanganisi amalinki amabili abe elilodwa: i-VPN ehleliwe idlulisa amaphakethe phakathi kwamanethiwekhi, kodwa ayithwali ubunikazi basendaweni yomliki bomakhelwane we-Ethernet okude inqamula umhubhe, ngakho ithrafikhi yasendaweni yomliki ihlala kumliki wayo.

Susa idivayisi futhi umzila uba ungenakubhalwa. ip -6 route add default via fe80::1 table 200 ayikwazi ukuxazulula isango, futhi i-iproute2 iyala ngale Error: Nexthop has invalid gateway. phutha. Engeza dev uplink0 futhi umyalo uphumelela, ngoba idivayisi iyona ebopha ihop elandelayo komunye walabo makhelwane ababili. Okungekho idivayisi engakusho ukuthi i-uplink0 ingumliki olungile waleli thebula yini, futhi umzila okopishwe kwenye i-host uza namagama e-interface alelo host, futhi amaphutha angempela avela lapho.

Isimo sokuqala: umliki owodwa noma amabili ethebuleni

Qala ngokuthi i-uplink yesibili ingeyani. Uma womabili amalinki ethwala ithrafikhi efanayo futhi elilodwa liyisipele, ithebula elihlukile kufanele libe namasango womabili ngamamethrikhi ahlukene: izindawo ezifanayo, umzila owodwa okhethwayo, ukukhetha kwesibili okucacile okukodwa. Uma ama-uplink ekhona ngoba ithrafikhi ehlukene kufanele iphume ngabahlinzeki abahlukene, noma ngoba lo kuwumhubhe ohlukanisiwe lapho ithrafikhi ethile idlula i-VPN kuyilapho insalela ihlala ngaphakathi, lawo malinki amabili awawona neze ithebula elilodwa. Ayingamalebula amabili, akhethwa umthetho, futhi umthetho ukhetha ithebula, hhayi umhubhe: ithrafikhi edlulayo imakwa ngaphambi kokuhlelwa, futhi lowo mkhawulo yiwo oyithumela ethebuleni lesibili.

Kuleso simo sesibili umthetho unquma ukuthi ithebula libhekwa nini, futhi umzila unquma ukuthi iphakethe liya kuphi ngemuva kwalokho:

ip -6 rule add fwmark 0x2 table 201
ip -6 route add default via fe80::1 dev uplink1 metric 100 table 201
ip -6 route add 2001:db8:100::/48 dev uplink1 metric 100 table 201
ip -6 route show table 201

Asikho into esikhundleni senye, futhi ithebula elinesimo esizenzakalelayo kuphela lingahluleka ukuxazulula isango lalo. Uma ukwengeza kunqatshiwe, noma umzila ukhona kodwa awusebenziseki, faka isiqalo esixhunyiwe sale interface kulelo thebula lifanayo, noma maka ihop njenge-onlink (lapho leso siqalo sihlelwa kwenye indawo). Kusigaba esingenhla 2001:db8:100::/48 simele leso siqalo esixhunyiwe ku-uplink1, hhayi indawo engahleliwe. Umthetho we-fwmark usebenzisa kuphela umaka okufanele uwubeke okunye, ovela kumthetho we-nftables noma we-iptables osendleleni yokudlulisa noma ovela ku-SO_MARK kusokhethi, ngakho isigaba esikopishiwe esingenamthombo womaka asihambisani nalutho.

Isimo sesibili: amamethrikhi awaboni umhlinzeki ofile

Imethrikhi iwukuthanda phakathi kwemizila ekhona, hhayi ukuhlolwa kwempilo. Uma umhlinzeki ewela, i-kernel isusa imizila kuleyo divayisi futhi isimo esizenzakalelayo sesibili sithatha izintambo. Uma intambo ihlala ivuliwe futhi umhlinzeki ongemuva wayo efa, akukho okushintshayo ethebuleni: umzila okhethwayo ufakiwe, umakhelwane uyafinyeleleka kusendlalelo 2, futhi amaphakethe aphuma aya emgodini omnyama. Uma lowo mehluko ubalulekile ekusethweni kwakho, ukushintshwa kokwehluleka kufanele kuvele entweni ehlola umzila futhi isuse umzila, kungaba idaemon yokuhlela noma iskripthi esincane esisusa bese sifaka kabusha ingeno.

Qinisekisa ukukhetha ngemuva kokwakhiwa kwethebula, futhi uqinisekise ngendlela i-kernel ezolibona ngayo. ip -6 route get 2001:db8:100::1 iphrinta umzila ongasetshenziswa, kufaka phakathi idivayisi nekheli lomthombo elikhethiwe, futhi ihlonipha imithetho yomgomo. Ikheli lomthombo elingelomliki ongafanele liyisibonakaliso esivamile sokuthi umthetho uhambisane ngaphambi kwalokho obukulindele.

Isimo sesithathu: nquma ukuthi ubani ungumnikazi wokuqhubeka

Umzila owengezwe nge-ip -6 route add uhlala kuze kube ukuqalisa kabusha noma kuze kube khona okususayo. Isimo esizenzakalelayo esifundwe ezimemezelweni zomzila sinenkathi yokuphila futhi umzila ungayihoxisa, kuyilapho isimo esizenzakalelayo esengezwe ngesandla singapheli ngokwaso. Ukuxuba kokubili ethebuleni elilodwa iyona ndlela umzila waphakade ogugile oqala ngayo ukwedlula owakamuva omenyezelwe, isikhathi eside ngemuva kokuba i-uplink eyayichazwa ingasekho.

Khetha umnikazi oyedwa ithebula ngalinye. Uma umphathi wenethiwekhi noma idaemon yokuhlela isivele ilawula i-interface, chaza umzila womgomo lapho futhi ushiye i-kernel. Uma ukwenza ngeskripthi, yenza kube yi-idempotent futhi ubhale ukuhlakaza ngesikhathi esifanayo, ngoba uzokudinga ekushintsheni okubi kokuqala:

ip -6 route flush table 201
ip -6 rule del fwmark 0x2 table 201

Kumzila odlulisela amanye ama-host, ngaphambi kokusola ithebula hlola net.ipv6.conf.all.forwarding . Uma ukudlulisa kuvaliwe, amaphakethe akheliwe kwenye inethiwekhi ayalahlwa, kungakhathaliseki ukuthi ithebula 201 lilungile kangakanani.

Rekhoda umklamo ukuze umuntu olandelayo akwazi ukuwuhlola

Uhlu olugcina kuphela fe80::1 lulahla izinkambu ezibalulekile. Rekhoda indawo, ihop elandelayo, idivayisi, ithebula nemethrikhi ndawonye, kanye nokuthi umzila ngamunye wavela kuphi: wamenyezelwa, wadalwa umphathi, noma awunakushintsha. Uma kamuva othile ebuza ukuthi i-uplink yesibili ithwala ngempela ithrafikhi yini, lowo mbhalo uphendula ngaphandle kokuqagela.

Ngaphambi kokumemezela ukuthi ithebula seliphelile, qinisekisa umakhelwane nge-ip -6 neigh show dev uplink0 , funda kabusha i-ip -6 rule show ukuze uthole izingozi zokulandelana, futhi uhlole ngethrafikhi ehambisana nomthetho esikhundleni se-ping ethatha umzila osizenzakalelayo. Bese wehlisa i-uplink eyodwa ngamabomu futhi ubheke ukuthi i-kernel ihlehlela kuwuphi umzila; impendulo kufanele ihambisane naleyo oyibhalile.