Ukunikezwa kwe-Prefix ye-IPv6 nge-VPN yendawo-kuya-endawo: uhlu lokuhlola

Ukwakha ithunele yingxenye elula. Ngike ngabona isixhumanisi sendawo-kuya-endawo sihlala sisunguliwe izinsuku ngenkathi wonke umsingathi ku-LAN ekude ethola ukuthula kuphela, ngoba i-prefix enikeziwe ngemuva kwalelo gewayo yayilungiselelwe ku-interface kodwa ayizange ihanjiswe ethuneleni. Amakheli ethunele ayephendula ama-ping sonke isikhathi, futhi yikho kanye okwenza ukuthi kungabikho muntu obheka i-prefix. Nansi indlela engiyihlolayo lapho i-prefix ye-IPv6 enikeziwe kufanele yeqe i-VPN yendawo: imephu ye-prefix, izikhethi zethrafikhi, ukudlulisela kanye ne-firewall, bese kuba yindlela yokubuya.

Bhala imephu ye-prefix ngaphambi kokuthinta ithunele

Ukunikezwa kwe-prefix kunikeza ibhlokhi kurotha eyicelile. Akufaki umzila ku-peer, akwandisi lelo bhlokhi njenge-on-link, futhi akutsheli igewayo elikude ukuthi yini engemuva kwerotha ecela. Lezi zinto ezintathu kufanele uzilungiselele wena, futhi zingena ohlelweni lwamakheli ngaphambi kokuba noma iyiphi ifayela lokuhlela lishintshe.

Endaweni ngayinye, bhala i-prefix enikeziwe, i-/64 esetshenziswa ngempela ku-LAN, amakheli ethunele kanye nomnikazi womzila ngamunye. Umhlinzeki unikeza indawo A i-2001:db8:a1::/56, esebenza i-2001:db8:a1:10::/64 ku-LAN yayo; indawo B igcina i-2001:db8:b2::/64. Uma indawo A isebenza leyo /64 eyodwa kuphela, zombili iziphetho kufanele zisho i-2001:db8:a1:10::/64 esikhundleni se-/56 yonke.

Cishe ngaso sonke isikhathi kuvela amaphutha amabili. Elinye ukuthatha i-prefix ekude njenge-on-link, ukuyixhumanisa noma ukuyibeka ku-interface yethunele ukuze igewayo liphendule isicelo somakhelwane sezingathi elingakwazi ukuzifinyelela. Elinye ukumenyezela i-/56 yonke lapho kuhlelelwe i-/64 eyodwa kuphela: ithebula lemizila lithi ibhlokhi iyafinyeleleka futhi iningi lamakheli liwela emgodini omnyama.

Vumelanisa izikhethi zethrafikhi zeziphetho zombili nemizila

I-IKEv2 ne-WireGuard zombili ziyenqaba ithrafikhi engavumelani, ngokuthula okwanele ukuthi ithunele libonakale liphilile.

Ku-strongSwan izikhethi zisobala. Endaweni A:

conn a-to-b
    left=2001:db8:ff::1
    leftsubnet=2001:db8:a1:10::/64
    right=2001:db8:ff::2
    rightsubnet=2001:db8:b2::/64
    auto=start

I-conn yendawo B ibonisa zombili izigaba zenethiwekhi. Uma zingavumelani, umphenduli wenqaba i-CHILD_SA nge-TS_UNACCEPTABLE, ngakho i-child SA ayikhuphuki nakancane nakuba i-IKE_SA ikhuphile. Ezinhlangothini zombili isigaba senethiwekhi esilungisiwe kufanele silingane nalokho okuhanjiswa i-kernel yasendaweni iya ethuneleni.

I-WireGuard ithwala ulwazi olufanayo ku-AllowedIPs, ngokuphenduka okukodwa: i-AllowedIPs iyisihlungi somthombo lapho yamukela futhi ingumzila lapho ithumela. Uma ingeno ye-peer yendawo B yendawo A ishiya i-2001:db8:a1:10::/64, amaphakethe avela endaweni A afika nge-handshake evumelekile futhi alahlwa njengangavunyelwe. Lokho kwakha iphethini ejwayelekile ye-handshake ehlala ivuselelwa kuyilapho kungabikho mpendulo ephumayo. Qhathanisa iziphetho zombili nge-wg show wg0 allowed-ips. Buyekeza lolo hlu ngaso sonke isikhathi lapho ukunikezwa kushintsha; i-/64 endala igcina isikhathi sisebenza futhi yenza i-prefix entsha ingafinyeleleki.

Qala ngokuqeda ukudlulisela, i-firewall ne-MTU

Ngaphambi kokufunda omunye umugqa we-log, qinisekisa ukuthi amagewayo ayadlulisela ngempela. I-sysctl net.ipv6.conf.all.forwarding kufanele ibuyisele u-1 kuzo zombili, isetshenziswa futhi kuma-interface ethunele ne-LAN. Kukhona ugibe oluhamba nayo: lapho ukudlulisela kuvuliwe, i-interface ene-accept_ra=1 iyeka ukwamukela izimemezelo zerotha ezivela kumhlinzeki, ngakho umshini ungalahlekelwa umzila ozenzakalelayo waphezulu nakuba uhanjisa kahle ngaphakathi kwethunele. Setha i-accept_ra=2 lapho i-RA yomhlinzeki isadingeka khona.

Ngemva kwalokho imithetho ye-firewall kufanele ivumele i-prefix kuzo zombili izinhlangothi, futhi i-ICMPv6 kufanele iphile: ukutholwa komakhelwane, i-packet-too-big ne-destination-unreachable akuzona eziqondiswayo. Uma uzilahla, ukutholwa kwe-MTU yendlela kuyaphuka, futhi uthola ukuxhumana okuvulekayo bese kuma empendulweni enkulu yokuqala. Ipheya yemigomo emincane ibukeka kanje:

nft add rule inet filter forward ip6 saddr 2001:db8:a1:10::/64 ip6 daddr 2001:db8:b2::/64 accept
nft add rule inet filter forward ip6 saddr 2001:db8:b2::/64 ip6 daddr 2001:db8:a1:10::/64 accept
nft add rule inet filter forward icmpv6 type { packet-too-big, nd-neighbor-solicit, nd-neighbor-advert } accept

I-MTU ingemuva kwalokhu. Ithunele linciphisa i-MTU esebenzisekayo ibe ngaphansi kuka-1500, futhi i-IPv6 ifuna ukuthi isixhumanisi ngasinye sithwale okungenani u-1280. Ama-ping amancane ayadlula, isikhathi se-SSH siyabanda lapho kuqhuma okukhulu, futhi i-/proc/net/snmp6 ibonisa imilayezo ye-packet-too-big engabuyi neze. Setha i-MTU yethunele ngokusobala, noma unciphise i-TCP MSS kuthebula le-mangle, futhi uvumele i-ICMPv6 ebika i-MTU encane ukuthi ibuye.

Hlola indlela yokubuya, hhayi ikheli lethunele

Ukwehluleka okuthatha isikhathi esiningi ukuhanjiswa ohlangothini olulodwa. Igewayo ngalinye lihanjisa i-prefix ekude ethuneleni, kodwa izingathi ziphendula ngokusebenzisa igewayo lazo elizenzakalelayo ngoba yilapho i-/64 yazo ikhona. Ukuletha iphakethe endaweni ekuthethwa ngayo kuyingxenye yendlela kuphela.

Imiyalo emibili ixazulula okuningi. Endaweni A, i-ip -6 route get 2001:db8:b2::53 from 2001:db8:a1:10::5 ibonisa ukuthi iyiphi i-interface impendulo evela kulo mthombo eyayizoyisebenzisa; yenza ukuhlola kwesibuko endaweni B. Bese ukhiqiza ithrafikhi isuka kumsingathi hhayi kugewayo, futhi uqhathanise izibali kuzo zombili iziphetho.

Uma isicelo somakhelwane se-prefix ekude sivela ethuneleni, leyo prefix ise-on-link endaweni lapho okwakungafanele ibe khona; lungisa lokho ngaphambi kokulungisa imizila. I-Proxy NDP ihlanganisa izimo lapho ukuxhumanisa kubalulekile ngempela, hhayi esikhundleni somzila.

Hlela ukushintsha kwe-prefix ngaphansi kwakho

Ukunikezwa kwe-prefix kuyisivumelwano sokuqashisa phakathi kwerotha elinikezayo nelicelayo, futhi ukuvuselela kungabuyisa ibhlokhi ehlukile: i-/56 ehlukile ngemuva kokufuduka komhlinzeki, noma isivumelwano esifushane kunaleso sikhathi ithunele likhona. Yonke indawo esho i-prefix endala iguga ngasikhathi sinye: imizila, izikhethi, i-AllowedIPs, imithetho ye-firewall, amarekhodi e-DNS kanye noma yikuphi ukuqapha okubhala amakheli angokoqobo ngokuqinile. Ukugeleza kwemilayezo kuku-RFC 8415.

Lapho i-prefix kulindeleke ukuthi inyakaze, gcina uhlelo lwamakheli lwangaphakathi olungayincikile futhi uhumushe emngceleni. I-NPTv6 iyinketho engenasimo futhi igcina inqubomgomo yangaphakathi ifundeka, kodwa ukuhumusha kwe-prefix, hhayi isendlalelo somlingo: imingcele ye-/64 kufanele ihambelane, ama-checksum ayashintshwa, futhi izinhlelo ezifaka amakheli angokoqobo ziyahluleka. Uma ugcina amakheli omhlinzeki kusuka ekugcineni kuze kube sekugcineni, bhala ukuziphatha kokuqashisa nenqubo yokushintsha ohlelweni lwamakheli.

Qedela ngokuhlola okumelana nesikhathi: umsingathi ovunyelwe ku-LAN ngayinye ufinyelela isevisi kwenye i-LAN, impendulo ibuya ngethunele, futhi labo mbhangqwana basasebenza ngemuva kokuqalisa kabusha ithunele nokuvuselelwa kokunikezwa. Uma ingxenye yokugcina yehluleka, umklamo uncike esimweni esingeke sidlule iviki.