Impendulo iphuma nge-LAN, hhayi ngomhubhe: kungani futhi kanjani

Isevisi eshicilelwe ngesango isebenza kusuka engxenyeni enkulu ye-inthanethi futhi yehluleka kusuka ehhovisi elilodwa. Othile uhlola umhubhe, ubona isicelo sifika abese ephetha ngokuthi impendulo kufanele ibuyele ngayo leyo ndlela. I-Linux ayisebenzi kanjalo, futhi akukho ukuhlola komhubhe okuzoshintsha impendulo. Impendulo ihlelwa ngokwendawo ekuyiwa kuyo, futhi lowo oshaya ucingo ohlulekayo usendaweni engaphansi (subnet) i-host eseyifinyelela ngqo.

Yini ngempela enquma iphakethe eliphumayo

I-kernel ibheka umzila wendawo iphakethe eliya kuyo, ihlola imithetho yenqubomgomo ngokulandelana kokubaluleka bese ibheka ithebula elikhethwa umthetho ohambisanayo. I-interface iphakethe elingene ngayo ayinayo indima, ngaphandle uma umthetho noma uphawu lubhaliwe ukuze ibe balulekile. Leli yiqiniso lomzila wale host, hhayi iphutha kumhubhe.

Ngakho-ke isicelo esitholwe ngomhubhe singakhipha impendulo ephuma nge-interface yenyama, futhi ukugeleza kuphenduka kube ngakolunye uhlangothi ngaphandle kokuthi noma iyiphi idivayisi ibike iphutha. Hlola izinhlangothi zombili ngaphambi kokuphetha ngomhubhe. Impendulo ephuma ngohlangothi olungalungile iyanyamalala kusuka kuzibali zomhubhe, yingakho iziphetho ezimbili zingavumelani ukuthi kukhona okuthunyelwe noma cha. Qaphela ukuthi iyiphi isibali esishintshile ngaphambi kokuthinta umthetho.

Kungani i-subnet yasendaweni inqoba

I-host enekheli kunethiwekhi yasendaweni inendawo exhunyiwe yalolo xhameleli etafuleni eliyinhloko, futhi indlela exhunyiwe iwukuhambisana okuqondile. Uma oshaya ucingo evela ku-subnet efanayo, ukusesha kuthola isixhumanisi sasendaweni ngaphambi kokuba umhubhe ucatshangelwe.

Ukungalingani yikho okwenza ukuxilongwa kudideke. Abashaya ucingo abavela ku-inthanethi ebanzi bayasebenza ngoba abahambisani nanoma iyiphi indlela yasendaweni, kanti lowo oshaya ucingo oyedwa owabelana ngexhameleli lehhovisi uyehluleka, futhi yilowo oshaya ucingo umuntu ahlola ngawo.

Ukufakwa kwabangane akufani nemizila efakiwe

Ohlangothini lomhubhe, izigaba ezivunyelwe ze-peer zichaza ukuthi yini engathunyelwa kumhubhe nokuthi imiphi imithombo eyamukelwayo kuwo. Azisho lutho mayelana nokuthi ithebula lomzila wasendaweni lizothumela kuphi iphakethe.

Uma ithuluzi lomhubhe lifaka indlela ezenzakalelayo ku-host, lingahudulela ithrafikhi engahlobene kumhubhe njengomonakalo oseceleni. Lapho umthetho wenqubomgomo kufanele ube nomqondo wokunquma khona, inketho yokufaka izindlela yethuluzi ikhona khona kanye ukuze kuvinjwe lokho, futhi amakheli, okhiye kanye nezilungiselelo zendawo yokugcina zihlala zinjengoba zinjalo. Indlela ezenzakalelayo eyengezwe ukuze kube lula iyindlela evamile i-host elahlekelwa ngayo inethiwekhi yayo yasendaweni.

Khetha ithebula ngekheli lomthombo

Umthetho osekelwe kumthombo uthumela izimpendulo ezisuka ekhelini lesevisi kubhebula eliyimfihlo okokusebenza kwayo okuzenzakalelayo kungumhubhe, kanti konke okunye kuqhubeka kusebenzisa ithebula eliyinhloko. Khetha izinombolo zethebula neziphambili ezingasetshenzisiwe endaweni, futhi ufunde imithetho ekhona ngaphambi kokufaka noma yini. Funda imithetho esebenzayo hhayi ifayela eligciniwe, ngoba womabili angahluka ngemva kokuqalisa kabusha.

ip -6 route add default dev wg0 table 200
ip -6 rule add priority 32000 from 2001:db8:aa::20/128 lookup 200
ip -6 rule add priority 32001 from 2001:db8:aa::20/128 unreachable

Umgqa wokugcina wenza indlela engekho yehluleke ngokubonakalayo esikhundleni sokubuyela ekuxhumaneni kwasendaweni. Umthombo kufanele ngempela wabelwe i-host, futhi ukusesha okuvamile kwasendaweni nokuyinhloko kufanele kuhlale ezindaweni zako zangaphambili. Umthetho ukhetha ithebula ngokomthombo; awuqhathanisi ubude bexhameleli phakathi kwamathebula.

Qinisekisa umzila, bese kuba yisevisi

Buza i-kernel ukuthi izokwenzani esikhundleni sokucabanga kusuka ekubanjweni, usebenzisa ikheli lesevisi njengesikhethi somthombo. Impendulo efanele lapha ilondoloza ukulandelela iphakethe konke.

ip -6 route get 2001:db8:bb::30 from 2001:db8:aa::20

Umphumela kufanele usho umhubhe. Bese uhlola umthombo ongawuthintanga futhi uqinisekise ukuthi usasebenzisa ukuxhumana kwasendaweni, ukuze ushintsho luhlale lulinganiselwe ekhelini elilodwa. Isikhethi esibanzi sasingeke sifakaze lutho mayelana nesikhalo sokuqala.

Lokhu akukulungisi

Shiya ukudlulisela, imithetho ye-firewall nokuziphatha kwe-ICMPv6 esangweni njengoba kwakunjalo, ngoba indlela yomthombo ayishintshi noma yikuphi kwalokho. Umlayezo we-Packet Too Big ongekho usaqhubeka uphula izimpendulo ezinkulu, kungakhathaliseki ukuthi yiliphi ithebula elinqobile ekusesheni. Lungisa lokho ngaphambi kokwengeza imithetho yomzila, ngaphandle kwalokho uphawu luzoqhubeka ngemuva koshintsho.

Qinisekisa imodeli yokushicilela ngaphambi kokusebenzisa noma yikuphi kwalokhu. I-proxy ehlanekezelwe evula ukuxhumana kwayo kwe-backend yethula umthombo wayo futhi ayigcini oshaya ucingo, ngakho-ke leli phutha alikwazi ukwenzeka kuleso sakhiwo. Ukusebenzisa umthetho lapho kuzongezwa okuhlukile komzila okungaxazululi lutho futhi okufihla imbangela yangempela.

Ekugcineni, bhala izinombolo zemithetho kanye nethebula ekuphathweni kokucushwa kwe-host. Umthetho wenqubomgomo owengezwe ngesandla uyanyamalala ekwakhiweni kabusha okulandelayo, futhi oshaya ucingo wasehhovisi ubuya nesikhalo esifanayo.