I-VPN ye-L2 ne-L3 tunnel: izinhlolovo ezinhlanu ngaphambi kokuhlanganisa isiza ngebhuloho

Uhlanganisa isiza ngebhuloho ngoba ithuluzi elithile liphikelela ngokuthi kumelwe libe kuyo leyo nethiwekhi, futhi emavikini amathathu kamuva ufunda amalogi eswishi ngehora lesibili ebusuku. Lowo mqondo wokucabanga unquma ngezixhumanisi eziningi kakhulu ze-Ethernet-over-IP. Lapha umehluko owodwa kuphela obalulekile ngempela: ukuthi izinhlaka eziphelele zihamba zisuka kwelinye icala ziya kwelinye, noma amaphakethe e-IP kuphela. Sebenzisa izinhlolovo ezinhlanu ngezansi ngokulandelana, futhi ume kokokuqala okwehlulekayo.

Hlola ukuthi uhlelo lufaka ini ngempela ocingweni

Ngaphambi kokuba noma yiliphi igama lomkhiqizo lingene engxoxweni, thatha umzuzu wethrafikhi okumelwe iwele isixhumanisi: tcpdump -i eth0 -nn -e 'not ip'. Le nketho -e iphrinta inhloko yesendlalelo sokuxhumana, futhi yiyo kanye ingxenye i-L3 tunnel eyilahayo. Uma ukuthwebula kuhlala kungenalutho, uhlelo lwakho lukhuluma i-IP futhi itunnel ehlelwe ngomzila iluthwala lingashintshile. Uma izinhlaka zivela, bhala i-EtherType, ngoba 0x0806 yi-ARP, 0x88cc yi-LLDP, futhi inani lomkhiqizi ngokuvamile lisho inqubo yokuthola engenayo indlela ye-IP. Yilapho khona lapho isixhumi esibonakalayo esivamile tun singasanele.

Phinda ukuthwebula ohlangothini olukude. Isinhlaka esikhona kuphela ngaphakathi kweswishi ekholelwayo yomsingathi oyedwa akusona isizathu sokunweba isizinda sokusakaza enqamula i-WAN.

Hlola ukuthi ukutholwa kumelwe kwele isixhumanisi yini

Itunnel ehlelwe ngomzila ayinayo ingxenye eyabiwe, ngakho akukho lutho olubhekelwe iqembu olufinyelela kwelinye icala. I-ARP, ukusakaza kwe-DHCP, i-mDNS ku- 224.0.0.251, i-SSDP kanye nemibuzo yamagama ye-NetBIOS konke kucabanga isixhumanisi ababona abaningi abangayizwa ngesikhathi esisodwa.

Buza ukuthi yikuphi kwalokhu uhlelo oluncike ngempela kukho, nokuthi ngabe isivele ikhona yini iphroksi yako. I-DHCP relay, ukubonakaliswa kwe-mDNS kanye namafayela e-ARP angaguquki ngakunye kususa ukuncika okukodwa, futhi ngakunye kuwusevisi enye okufanele isetshenzwe futhi iqashwe. Uma kusala okubili noma okuthathu, ukuhlanganisa ngebhuloho iyimpendulo eqotho.

Hlola ukuthi inhloko eyengeziwe ikubiza malini

Izinhlaka zidinga indawo yokuhlala, ngakho konke okukuthumelayo kuthola isiteki sesibili senhloko esizungezile. Ku-overlay ye-VXLAN lokho kusho inhloko ye-IP yangaphandle, inhloko ye-UDP kanye nenhloko ye-VXLAN yamabhayithi angu-8, okusunduza umthwalo ogcwele wamabhayithi angu-1,500 ngale kwe-MTU yomzila wesixhumanisi esijwayelekile se-inthanethi samabhayithi angu-1,500. I-OpenVPN kwimodi ye- tap yengeza indleko yayo ngakwona lowo mkhakha. Ngaphandle kwe-MTU ephansi ngaphakathi uthola isixhumanisi esiphendula i-ping kodwa sima ekudlulisweni okukhulu kokuqala.

Ibili ayimi kumabhayithi enhloko. Ukusakaza kanye ne-multicast esikwenziwa iswishi kuzo izinto ezibonakalayo manje kuhamba nge-WAN, futhi isiza ngasinye esihlanganisiwe ngebhuloho sizuze ifa uhlelo lwamakheli olufanayo, ububanzi be-DHCP kanye nokuziphatha kwamakheli aphindwe kabili. Lokho kwenza isixhumanisi sibe nzima kakhulu ukusicwaninga kuneqoqo elihlelwe ngomzila elinepherefeksi eyodwa ngesiza.

Bala ngaphambi kokukhetha. Ingxenye ematasa ekhunjulwa izikhathi ezintathu ingahambisa ithrafikhi yokusakaza engaphezulu kunokudluliswa kwamafayela eyakhelwe kona.

Hlola ukuthi uluphi uhlobo lwe-VPN ye-L2 olunikezwayo kuwe

Ithemu ngokwalo alicaci, futhi ukungacaci kwalokho kunquma ukuthi ngubani othwala ithrafikhi yakho. Ngezinye izikhathi lichaza umthwalo: izinhlaka ze-Ethernet ngaphakathi kwe-IP, ezithunyelwa nge-inthanethi njenganoma iyiphi enye indlela yokuxhumana esemgqeni, njengoba kwenza i-VXLAN, iZeroTier kanye nemodi ye- tap ye-OpenVPN. Ngezinye izikhathi lichaza isevisi ethengiwe: isekethe ye-Ethernet yomhlinzeki noma ucingo lwenkohliso lwe-MPLS oluhlanganisa iziza ezimbili ngaphakathi kwenethiwekhi eyodwa yomhlinzeki.

Kokubili kukunika ingxenye, ngakho uhlelo alukwazi ukuhlukanisa, kodwa umehluko wokusebenza mkhulu. I-overlay ikushiya nomthwalo we-MTU, ukubethela kanye nomzila ongaphansi. Isevisi yomhlinzeki ithatha leyo futhi iyikhokhise, futhi ngeke neze ihambe izinhlaka zakho nge-inthanethi yomphakathi. Ukuthi yikuphi okufunayo kuncike ekutheni iziza ezimbili zabelana ngomqhubi oyedwa noma zabelana ngenkampani kuphela.

Hlola isisombululo esishibhile ngaphambi kokuhlanganisa ngebhuloho

Iningi lezicelo zesixhumanisi esihlanganisiwe ngebhuloho livela ekusesheni kwegama elilodwa eliphukile, hhayi enqubweni edinga ngempela izinhlaka. Dlulisa kuqala isixazululi kanye nesizinda sosesho ngendlela yokuxhumana ehlelwe ngomzila: dhcp-option DNS 10.8.0.1 kanye dhcp-option DOMAIN internal.example kusimo sokulungiselela iseva ye-OpenVPN kuxazulula inani elimangazayo lazo. Isidlulisi sasendaweni ohlangothini olukude senza umsebenzi ofanayo ngaphandle kokuhambisa noma iyiphi ithrafikhi yokusakaza.

Uma ithuluzi elilodwa elidala lihluleka, beka lelo thuluzi ngemuva kwephroksi noma umsingathi wokugxuma engxenyeni yendawo okuyiwa kuyo. Isidlulisi esisodwa se-TCP sishibhile ukuqhuba kune-WAN ehlanganisiwe ngebhuloho.

Vala isinqumo ngokulandelana: ingabe ithrafikhi ithwala i-EtherType engeyona eye-IP, ingabe ukutholwa kumelwe kwele, ingabe i-MTU ingakwazi ukugwinya izinhloko ezengeziwe, ingabe isekethe yomhlinzeki ikhona ngempela, futhi ingabe isisombululo esihlelwe ngomzila sehlulekile ngesizathu ongasisho? Cha kunoma yisiphi isinyathelo siqeda impikiswano ivuna indlela yokuxhumana osuvele unayo. Gcina ukuthwebula kanye nohlu lwe-EtherType kanye nerekhodi loshintsho, ngoba umuntu olandelayo uzobuza umbuzo ofanayo futhi ngeke afune ukuphinda isilinganiso.