Ibhubhu le-TAP elihlukanisiwe phakathi kwamabhodi amabili nge-OpenVPN

Amabhodi amabili okuthuthukisa adinga ukwabelana ngesigaba esisodwa se-Ethernet ngenkathi amabhentshi awo ekwezakhiwo ezahlukene. Umhubhe usuvele ukhona futhi usuvele uthwala i-Ethernet, ngakho umsebenzi osele ubonakala njengemiyalo emithathu futhi awunjalo. Lokho umsingathi akwenzayo ngefremu elethwe ibhubhu, lapho ikheli lekhompyutha uqobo likhona, nokuthi yimuphi umngcele ibhubhu engawudali kungamaqiniso amathathu ahlukene, futhi ukungalungi kwesibili yisizathu esivamile sokuthi ilabhu isebenze ngezikhathi futhi ukufinyelela kwayo kokuphatha kwehle buthule. Awekho kula maqiniso amathathu abonakalayo kumdwebo we-topology.

Indlela engezansi icabanga ukuxhumana kwe-TAP okuqinisekisiwe phakathi kwamakhompyutha amabili e-Linux, iphothi elisodwa elinentambo elikhethekile lebhentshi ngalinye, kanye ne-interface yokuphatha engeyona ingxenye yocwaningo. Ukulandelana kubalulekile: amafremu kuqala, amakheli emva kwalokho, umngcele ekugcineni.

Yini ibhubhu eliyihambisayo ngempela

Ibhubhu iyiswishi esetshenziswe kusofthiwe. Ifunda ukuthi yiliphi ikheli le-MAC elivela ngemuva kweliphi iphothi eliyilungu futhi lidlulisa amafremu phakathi kwamalungu ngaphandle kokubheka ithebula lokuhamba kwe-IP. Akukho kulokho kuchaza okubandakanya i-subnet, isango noma umzila ozenzakalelayo, yingakho ukunika amandla ukudluliswa kwe-IP kungakudali lokhu kuxhumana futhi yingakho i-ping ingaphumelela kuyilapho enye ithrafikhi isahluleka. Ibhodi lingafinyelela umlingani walo ngaphandle komzila ozenzakalelayo ohleliwe, okumangaza labo abalindele ukuthi isendlalelo sesibili siziphatha njengesesithathu.

Ikhompyutha ngayinye inikela ngephothi elilodwa elinentambo ebhujwini kanye nedivayisi ye-TAP kwibhubhu elifanayo, ngakho ifremu evela ebhodini ingena ephothini lendawo, idluliselwe kudivayisi ye-TAP, yeqe umhubhe, ifike kudivayisi ye-TAP yomlingani futhi idluliselwe ebhodini lomlingani. Umhubhe uyiphothi eliyilungu njenganoma yiliphi elinye, futhi ibhubhu alazi futhi alikhathazeki ngokuthi kukhona i-VPN ngemuva kwalo. Yilokho kulingana okwenza isibonelo kube lula ukucabanga ngaso: uhlangothi ngalunye lunephothi elibheke elabhorethri kanye nephothi lomhubhe, futhi alukho uhlangothi olukhethekile.

Board A -- bench0 -- br-test -- tap-bench
                                 |  OpenVPN TAP
Board B -- bench0 -- br-test -- tap-bench

Amagama afanayo kumakhompyutha womabili angamagama endawo, hhayi izinto ezabiwe. Kunendlela eyodwa ye-Ethernet phakathi kwamabhentshi, ngaphandle kwekhebula lesibili nangaphandle komhubhe wesibili ovala umjikelezo; ibhubhu elibona i-MAC efanayo ifika kumaphothi amabili lizodlulisa ngokujabulayyo emibuthanweni.

Nikeza ibhubhu ikheli, hhayi amaphothi alo angamalungu

Ubunikazi bekhompyutha esigabeni selabhorethri bungelobhubhu lwedivayisi. Amaphothi angamalungu ahlala engenazinamba, ngoba iphothi liyilungu elidlulisayo futhi ikheli kulo lingakha umnikazi wesibili oqhudelanayo waleso sigaba. Lokhu ukulungiswa okwenziwa ngokungalungile yizinhlaka eziningi ezenziwe ngesandla: zinikeza ikheli kudivayisi ye-TAP nakubhubhu, bese zizibuza ukuthi umlingani ufinyelela kukuphi ngempela.

ip link add br-test type bridge
ip link set bench0 master br-test
ip link set tap-bench master br-test
ip address add 172.30.90.2/24 dev br-test
ip link set bench0 up
ip link set tap-bench up
ip link set br-test up

Umlingani usebenzisa isimo esifanayo ngekheli lomsingathi elihlukile, futhi amabhodi athatha amakheli ebangeni elifanayo esebenzisa ikheli lebhubhu lekhompyutha njengokugxuma okulandelayo uma likudinga. Sebenzisa amabanga emibhalo kuze kuvunyelwane ngohlelo, futhi ubeke ibanga eceleni ukuze lingashayisani nanoma yini ihhovisi elivele liyihambisa. Ngaphambi kokusebenzisa noma yikuphi kwalokho, qinisekisa ukuthi amaphothi angamalungu awanakheli asele, awekho iklayenti le-DHCP futhi awanabungu kubhubhu elinye, futhi uvumelanise ukunikezwa kwamakheli kwedivayisi ye-TAP ngokusebenzisa lokho okuphethe ukuhlelwa komhubhe ukuze kungabuyisi ikheli kamuva.

Kungani iphothi elilodwa elikhethekile lebhentshi ngalinye

Iphothi elinentambo elikhethekile yilona elivimbela ucwaningo ukuba lube ushintsho lwehhovisi lonke. I-interface yokuphatha ithwala i-SSH, umzila ozenzakalelayo kanye nokuxhumana kwe-VPN kwangaphandle, futhi akukho kulokho okungokwebhubhu okugxile ekuhambiseni amafremu elabhorethri.

Ukuxhuma i-adaptha yokuphatha kubeka i-LAN yehhovisi ebangeni lesinqumo esisodwa sokudlulisa ukusuka ebhodini lokuthuthukisa, futhi ibhodi eliziphatha kabi esendlalelweni sesibili yilona hlobo lwedivayisi ongayifuni kuleso sigaba. I-adaptha ye-Wi-Fi yimbi kakhulu: ukubhubha kwe-interface engenantambo kumodi yengqalasizinda akuziphathi njengokubhubha kwe-Ethernet, futhi ukwehluleka kuyadida kunokuba kuhlanzeke.

Gcina ibanga lelabhorethri ngaphandle kwanoma yisiphi isikhala se-DHCP sokukhiqiza. Uma amabhodi edinga amakheli ashintshayo kamuva, isabi sokunikeza esigunyaziwe esisodwa esinechibi elilodwa yiso kuphela isimo esihlala sibikezela; amarawutha ajwayelekile ezindawo ezimbili aphendula esigabeni esifanayo akhiqiza amakheli okungekho muntu ongawachaza.

Umngcele ibhubhu elingawudali

Ukubhubha akukhona ukuhambisa, futhi akukhona nokuhlukanisa. Amafremu adlula ebhujwini asengafinyelela kumahuku okuhlunga omsingathi, kuye ngomzila we-bridge-netfilter ofakiwe, ngakho inqubomgomo esebenzayo kufanele ihlolwe hhayi ukucatshangwa. Ukucisha i-firewall ngoba ilahlekelwe ifremu elilodwa kushintsha iphutha elithile ngephutha elijwayelekile.

Ukudluliswa kwe-IP phakathi kwebhubhu nayo yonke i-interface yokuphatha noma ye-uplink kufanele kuhlale kucishiwe noma kunqatshwe ngokucacile, futhi lokhu kuwukulawula okuhlukile kubungu bebhubhu. Ibhodi elikhetha ikheli lelabhorethri lekhompyutha njengesango laso lihlola khona lokhu: uma ukudlula kokuphatha kuphumelela, umngcele owawuqonde awukaze ube khona.

Eminye imindeni emibili ifanele isinqumo esicacile. Uhlelo lwamakheli alwenzi ibhubhu libe yi-IPv4 kuphela, ngakho i-IPv6 namanye ama-EtherType adinga uhlelo lwawo noma isihlungi. Futhi i-ping ephumelelayo ayisho lutho mayelana nokuthi ukusakazwa kokuthola kwebhodi, amaqembu e-multicast noma amafremu e-jumbo kuzodlula indlela, ngoba lezo ziyizigaba zethrafikhi ezahlukene ezinokungagqagqi okuhlukile.

Ekugcineni, ukuthutha nokufihlakala kungukuthenga okubili okuhlukene. I-TAP ithwala i-Ethernet; insizakalo ye-OpenVPN ihlinzeka ngokuvikelwa okuzungezile. Isembozo se-VXLAN naso sithwala i-Ethernet futhi asihlinzeki ngokufihlakala ngokwaso, ngakho ukushintsha enye ngenye kushintsha izici zokuphepha ngisho noma umdwebo we-topology ubonakala ufanayo.

Ukuqina kanye nokuhlolwa okukufakazayo

Umyalo othayiphwe kanye ngemuva kokuxhumana awukona ukuhlelwa. Yenza ibhubhu, ubungu bamaphothi kanye nekheli elilodwa lomsingathi kuhlale njalo ngokusebenzisa umphathi wenethiwekhi okhona wekhompyutha, futhi uhlanganise ukuxhumana nokuvela kwedivayisi ye-TAP ukuze ukuxhumana kabusha kungashiyi ibhubhu elinelungu elinyamalele.

bridge link show
ip -d link show br-test
bridge fdb show br br-test | head

Bese uhlola lokho amabhodi akudinga ngempela kuzo zombili izinhlangothi, uxhume umhubhe futhi, futhi uqalise kabusha ikhompyutha eyodwa ngokuhlelo lokubuyisela olugunyaziwe. Qinisekisa izinto ezintathu ngemuva kwalokho: ukufinyelela kokuphatha kusasebenza ngokuzimela, akukho kheli lelabhorethri eliphindwe kabili elivelayo, futhi ayikho i-interface yokukhiqiza engalindelekile ejoyine ibhubhu. Levo nhlanganisela iwubufakazi bokuthi ucwaningo lwahlala ngaphakathi kwebhentshi lalo.