Kungani i-LAN host ithumela i-ARP ekhelini le-OpenVPN client

Izinkinga zokufinyelela phakathi kwe-LAN host ne-VPN client zivame ukubuyela ohlelweni lwamakheli ngokwalo. Nikeza ley host i-interface ku-10.0.100.0/22 futhi izothatha yonke ikheli kusukela ku-10.0.100.0 kuya ku-10.0.103.255 njengokuxhumene ngqo, kuhlanganise nephuli lamaklayenti elibekwe buthule ku-10.0.101.0/24. Impendulo ayiyi neze kumzila, ngoba ngokombono we-host akukho mzila ohilelekile. Iphakethe likhethelwe umakhelwane futhi licelwa ocingweni.

Leyo ndlela isemva komndeni wonke wemibiko: ithaneli ivuliwe, iseva inomzila, kodwa i-LAN host ayikwazi ukufinyelela iklayenti.

Isandiso esingu-/22 esigwinya esingu-/24

Funda isandiso njengebanga, hhayi njengochungechunge lwezinhlamvu. Isandiso esingu-/22 siqukethe amakheli angu-1024, futhi u-10.0.100.0/22 usuka ku-10.0.100.0 kuya ku-10.0.103.255, ngakho iphuli ku-10.0.101.0/24 lilele ngokuphelele ngaphakathi. Leli phutha liyasinda ekubuyekezweni ngoba ama-octet okuqala ephuli abukeka ehlukile kunama-octet okuqala e-LAN, futhi i-octet yesithathu kuphela eveza ukuhlanganisa. Bhala womabili amabanga ngezinombolo ngaphambi kokuwamemezela ehlukene.

Ukuhlanganisa okufanayo kungavela ngakolunye uhlangothi. Iphuli elibukeka lingenalutho ngoba akekho olisebenzisayo manje lisengawela ngaphakathi kwesandiso esimenywe isimila sokusayithi, futhi uhlelo lwamakheli yilona kuphela idokhumenti elikubonisayo lokho.

Ukuxhumana okuqondile kusho i-ARP, hhayi ukuhambahamba komzila

Lapho i-host ene-interface engu-/22 ithumela ku-10.0.101.25, i-kernel iqhathanisa indawo yokufika nesandiso se-interface futhi ithole ukufana. Iphakethe liba ukuseshwa komakhelwane esikhundleni sephakethe elihambile ngomzila, futhi ku-Ethernet ukuseshwa komakhelwane isicelo se-ARP salelo kheli. Uma ikheli lingeliklayenti le-VPN elingemva kwesango elihambile ngomzila, akekho i-host ku-LAN olinikile, ngakho isicelo sihlala singaphendulwanga futhi amaphakethe ayaphonswa. Ithaneli alinacala, futhi iklayenti alikuboni ukuhamba kwezinto.

Yingakho ukwehluleka kubukeka kungalingani futhi ngezinye izikhathi kuyanqamuka. I-VPN host ivame ukufinyelela i-LAN ngoba imizila yayo ikhomba indlela efanele, kuyilapho i-LAN host ingakwazi ukuphendula, futhi noma yini egcina i-ARP entry endala yenza uphawu lukhanyise bese lucima.

I-TUN, i-TAP kanye nalokho okuthwelwa yilowo nalowo

Idivayisi ye-TUN ithwala amaphakethe e-IP, futhi idivayisi ye-TAP ithwala amafremu e-Ethernet. Isixhumanisi se-TUN esihambile ngomzila asidingi ukuthwala i-ARP ukuze sinikeze ukufinyeleleka kwe-IP, futhi yingakho isicelo esingaphendulwanga ngenhla silindelekile hhayi esiphukile. I-TAP enebhuloho elenziwe ngamabomu ingakhulisa isizinda sokusakaza futhi yenze i-ARP isebenze, kodwa ishintsha lokho iklayenti elingakubona, idinga amaphoyinti okugcina asekela ukuhlanganiswa okufanayo, futhi iwukwakhiwa kabusha kwemodeli yenethiwekhi hhayi ukulungiswa kwesandiso esihlangene. Ukushintsha ukusetshenziswa okuhambile ngomzila kuya ku-TAP ukuze kwelashwe iphutha lohlelo lwamakheli kushintshanisa inkinga encane ngenkulu.

Bhala lapho isicelo se-ARP savela khona nokuthi yiluphi uhlelo esalithumela ngaphambi kokuthatha izinqumo. Umthumeli ukutshela ukuthi ukholelwa ini ngendawo yokufika, hhayi ukuthi ithaneli lenza ini.

Dizayina iphuli elingakwazi ukuhlanganisa

Khetha iphuli ngaphandle kwesandiso ngasinye esixhunyiwe kanye nesandiso ngasinye sokusayithi esimenyeziwe, bese wengeza imizila eyenza lifinyeleleke ngalazo zombili izinhlangothi. Ibanga elifana no-10.8.0.0/24 engxenyeni engasetshenziswanga yohlelo kulula ukucabanga ngayo, futhi i-LAN edinga ukulifinyelela ithola umzila oqinile okhomba kuseva ye-VPN. Shintsha kanyekanye ukwabiwa, imizila emenyeziwe, amakheli omthombo avunyelwe kanye nemithetho yodonga lomlilo, ngoba ichaza idizayini eyodwa hhayi izilungiselelo ezine.

I-Source NAT kuseva ingafihla iphuli ngemva kwekheli elihambeka ngomzila lisuka ku-LAN, futhi iyithuluzi lokufuduka elisemthethweni. Futhi ibhala kabusha umthombo, ngakho i-LAN ilahlekelwa amandla okuhlobanisa ukuxhumana namaklayenti ngamanye nokufaka imithetho ngeklayenti ngalinye.

Ukuze kwamukelwe, sebenzisa ikheli elinikezwe ngempela iklayenti langempela kanye nesicelo sohlelo langempela esivela ku-LAN host, bese uqinisekisa ukuthi impendulo ilandela isango elihleliwe hhayi ucingo.