IPv6 ngomhubhe we-OpenVPN: uhambo lwasekhaya lwerutha

Ikhompyutha ephathekayo inekheli le-IPv6, umhubhe uthweswe phezu kwe-IPv4, kodwa konke ukuhlolwa kwe-IPv6 kuyahluleka. Noma okubi kakhulu: ukuhlolwa kuyaphumelela futhi ithrafikhi iphuma ngomzila womhlinzeki ngaphandle kokungena emhubheni nhlobo. Yomibili imiphumela ibuyela esinqumweni esisodwa esingekho: akekho onikeze irutha isiqalo ebesingayihambisa ngaso iya kumaklayenti. Ukuhamba ngomzila usuka kuklayenti uya ngaphandle kuthola ukuthi iyiphi ingxenye engekho.

Qala lapho iklayenti likhona

Bheka iklayenti ngaphambi kokuthinta iseva. ip -6 addr kufanele ikhombise ikheli lomhubhe elivela kuphuli, futhi ip -6 route kufanele ikhombise isiqalo esiphushelwe esikhomba kudivayisi yomhubhe. Uma ikheli likhona kodwa umzila ungekho, ukusunduza akukho noma iklayenti likushaye indiva. Uma kokubili kungekho, iseva ayihlinzekanga lutho nhlobo.

Bese uhlola ukuthi iklayenti licabangani ngomhlaba wangaphandle. Umzila ozenzakalelayo phezu komhubhe ufuna yonke ithrafikhi ye-IPv6, kanti umzila we-2000::/3 ufuna i-unicast yomhlaba wonke kuphela. Kokubili kungaba yiqiniso, futhi kuphendula imibuzo ehlukene mayelana nokuvuza.

Iklayenti elingenalo umzila ozenzakalelayo we-IPv6 lihluleka kukho konke ukuhlolwa komphakathi nakuba umhubhe ngokwawo uphilile ngokuphelele. Leyo iyigeja kwenqubomgomo, hhayi umhubhe ophukile.

Hlola iphuli irutha engayihambisa ngempela

Iseva inganikeza kuphela kusiqalo esiyilawulayo ngempela. Uma umhlinzeki edlulisa i-/56, gcina i-/64 eyodwa yomhubhe bese ushiya okusele kwi-LAN. Lapho umhlinzeki enikeza kuphela i-/64 eyodwa ku-WAN futhi engahambisi okunye, shiya isiqalo se-LAN njengoba sinjalo futhi unikeze umhubhe ibanga lendawo eliyingqayizivele, uvuma ukuthi amaklayenti ngeke abe nokuphuma emhlabeni wonke.

Iphuli nokusunduza kuhamba ndawonye. server-ipv6 2001:db8:80:10::/64 inikeza amakheli, futhi push "route-ipv6 2000::/3" itshela amaklayenti ukuthi yini abayithumele emhubheni. Ukusunduza i-2000::/3 kuhlanganisa i-unicast yomhlaba wonke futhi kushiya amabanga e-link-local ne-multicast ngaphandle komhubhe.

Bhala isiqalo esikhethiwe kurekhodi lokusetshenziswa. Ozoshintsha ukudluliswa komhlinzeki ngokuzayo kufanele azi ukuthi iyiphi i-/64 umhubhe osewuyithathile.

Vula ukudlulisela kwelinye ikhaya

Ukudlulisela kwe-IPv4 akusho ukudlulisela kwe-IPv6. Setha i-net.ipv6.conf.all.forwarding=1 bese ukhombisa konke okuvunyelwe yinqubomgomo ye-FORWARD ye-IPv4 kakade. Kurutha ochungechunge lwayo lwe-FORWARD lulahla ngokuzenzakalela, iqoqo lemithetho elingekho libukeka njengomhubhe ofile.

Ukuxhawula kuphumelela, iklayenti lithola ikheli, futhi akukho okubuyayo. Engeza imithetho yazo zombili izinhlangothi kanye nomlenze we-WAN, ngoba umhubhe ofinyelela i-LAN kodwa hhayi i-inthanethi wehluleka ekuhlolweni kwesithathu. Ngemva komzamo ohlulekile bheka izibali zochungechunge, ngoba umthetho ongakaze uhlangane uyinkinga ehlukile kunalowo ohlangene wabe elahla.

ip6tables -A FORWARD -i br0 -o tun0 -j ACCEPT
ip6tables -A FORWARD -i tun0 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i tun0 -o wan0 -j ACCEPT

Umphumela owodwa oseceleni ubamba abantu abagcina ngokumangalela umhubhe. Ukuvula ukudlulisela kwenza ingqikithi yeqise ukucushwa kwekheli ngokusebenzisa iSaziso Serutha ngaphandle uma kushiwo okunye, futhi umzila ozenzakalelayo ofundwe kanjalo unyamalala nawo. Noma gcina umzila ozenzakalelayo ocacile kusixhumi se-WAN, noma setha lapho i-accept_ra ibe ngu-2 ngamabomu. Ngemva kwanoma yiluphi ushintsho, qinisekisa ukuthi irutha isenomzila we-IPv6 osebenzayo wokuphuma ngaphambi kokuhlola amaklayenti futhi.

Phendula ekutholakaleni komakhelwane uma ingxenye ephezulu ingahambisi

Imishini ephezulu ngezinye izikhathi ithatha i-/64 edlulisiwe njengeyingxenye yoxhumo lwayo futhi iyenqaba ukuhambisa noma yisiphi isiqalo esingaphansi esiya ebhokisini le-VPN. Uma lokho kwenzeka, kufanele kube khona okuphendula izicelo zomakhelwane zekheli ngalinye leklayenti ngokwehlukana.

OpenVPN iveza ikheli elinikeziwe ku-hook ye-client-connect, ngakho okufakiwe kungalandela iphuli langempela esikhundleni sohlu olugcinwa ngesandla. I-hook yengeza i-ip -6 neigh add proxy $ifconfig_pool_remote_ip6 dev eth0, futhi i-hook ye-client-disconnect ehambisanayo iyisusa. Ngaphandle kokususwa, ithebula le-proxy liyaguga futhi iklayenti elizayo lingazuza njengefa okufakiwe kwekheli elingakaze likuthole. Qinisekisa isimo nge-ip -6 neigh show proxy.

Thatha i-proxy njengesixazululo sokuchezuka. Umzila oqinile we-/64 yomhubhe oqondiswe kurutha uyaphila ezinguqukweni zamaklayenti futhi awudingi nhlobo i-hook yesegobhu enamalungelo.

Landela umzila uya ngaphandle, igxathu ngalinye

Hlola ukuya ngaphandle ngezinyathelo ezintathu: okokuqala ikheli lomhubhe lerutha, bese kuba umphathi we-LAN, futhi okwesithathu indawo yomphakathi nge-traceroute6. Iphuli lifakazwa okokuqala, ukudlulisela kanye nodonga lomlilo lwe-LAN okwesibili, futhi indlela yokubuya ngengxenye ephezulu okwesithathu. Ukwehluleka ngakunye kunciphisa ukusesha kudivayisi eyodwa esikhundleni sokuphinda kuvulwe wonke umklamo.

Bheka i-MTU yomhubhe, ngoba amarutha e-IPv6 asendleleni ngeke ahlukanise ngenxa yakho. I-MTU enkulu kakhulu ibonakala njengephutha le-packet-too-big kanye ne-TLS emile esikhundleni sokwehluleka okuhlanzekile. Yisethe ngokucacile futhi uhlole ngomthwalo oseduze komkhawulo.