I-Linux EHOSTUNREACH ne-OpenVPN: yikuphi ukuhamba okulandelayo okwehlulekile?

I-EHOSTUNREACH ivamise ukuba yisinqumo sasendaweni njengoba nje iwukwehluleka kokude. I-kernel ingalahla iphakethe ngoba umzila uthi indawo okuyiwa kuyo ayifinyeleleki, ngoba ukuhamba okulandelayo kwe-Ethernet akukaze kuphendule, noma ngoba umbiko we-ICMP host-unreachable ufike uvela kude emzileni. Umthombo ngamunye uhlala kuthebula noma ku-cache ehlukile, futhi ngamunye ulungiswa endaweni ehlukile. Funda umzila okhethiwe kanye nesimo sokuhamba okulandelayo ngaphambi kokuthinta ama-cipher noma ukufaka umhubhe kabusha.

Khetha ikheli ne-namespace iklayenti elilusebenzisa ngempela

Qala ngokubeka indawo okuyiwa kuyo kanye ne-namespace yenethiwekhi eyadala iphutha. Iklayenti le-VPN lingase lisebenze ku-namespace yalo, futhi ukusesha okuvela kokumisiwe kubheka ithebula lomzila elihlukile elinemithertho ehlukile yenqubomgomo.

Ukusesha kufanele kusebenzise umthombo ofanayo, i-mark kanye nomongo wethebula njengohlelo olwehlulekayo, ngaphandle kwalokho kungaphendula umbuzo ongabuzwanga muntu. Ku-peer ye-IPv4 eyisibonelo, ukuhlola kokufunda kuphela yilokhu:

ip -4 route get 198.51.100.25
ip -4 neigh show 198.51.100.1
ip -4 route show table all | grep -w unreachable

Umphumela ovela ku-shell yokuphatha ufakazela kuphela lokho i-shell leyo ebingakwenza. Uma iklayenti libeka i-firewall mark noma lihlanganisa ne-VRF, phinda ukusesha nge-mark efanele noma ngaphakathi kwe-VRF, bese uqhathanisa umzila okhethiwe nokuhamba okulandelayo. Ikheli lokuqala okufanele liqinisekiswe ikheli le-peer elikwiprofile, hhayi iqembu noma insizakalo eshiwo umsebenzisi.

Umzila ocacile we-unreachable unqaba iphakethe endaweni

Umzila wohlobo lwe-unreachable uyimpendulo yasendaweni eyenziwe ngamabomu. Utshela i-kernel ukuthi ilahle iphakethe futhi ibuyisele i-EHOSTUNREACH kumthumeli, yingakho iphutha livela ngokushesha ngaphandle kwanoma yikuphi ukuhamba okuphuma emshinini. Othile, noma i-automation ethile, wabeka lowo mzila lapho ngamabomu.

Izinhlobo zemizila azikwazi ukushintshana. I-blackhole ilahla iphakethe ngaphandle kwephutha kumthumeli, i-prohibit ibuyisela i-EACCES, kanti i-unreachable ibuyisela i-EHOSTUNREACH. Umsizi we-VPN ofaka umzila we-sink ngesikhathi sokuxhuma kabusha ngakho-ke angakhipha iqoqo lamaphutha e-host-unreachable anyamalalayo lapho umhubhe ususungulwe, kuyilapho umzila we-blackhole ungakhipha izikhathi zokuphela ezithule esikhundleni salokho.

Sesha uhlobo kuzo zonke izithebula ngaphambi kokusola ukuphela okukude. Umthetho okhetha ithebula ubalulekile njengomzila ongaphakathi kulo, futhi umzila owengezwa kuthebula eliyinhloko ngeke usize iklayenti umthetho walo wenqubomgomo uthumela ukuhamba kwenye indawo.

Umakhelwane ofile ukhipha iphutha elifanayo ku-Ethernet

Lapho umzila okhethiwe usebenzisa isango le-on-link, ukulethwa kudinga ikheli lesendlalelo sokuxhumana elixazululiwe. I-kernel ithumela i-ARP noma isicelo sikamakhelwane se-IPv6, futhi uma impendulo ingafiki iphakethe alikwazi ukwenziwa ifremu. Ukuthumela khona-ke kwehluleka nge-EHOSTUNREACH nakuba umzila ngokwawo uvumelekile.

Ithebula likamakhelwane lisho isigaba. I-INCOMPLETE isho ukuthi ukuxazulula kusaqhubeka, i-FAILED isho ukuthi umzamo wokugcina awutholanga mpendulo, futhi i-REACHABLE noma i-STALE isho ukuthi i-kernel inekheli elisebenzisekayo. Ingqophamlando ye-FAILED yesango le-VPN iyinkinga yokulethwa yasendaweni, hhayi ubufakazi ngohlangothi olukude lomhubhe.

Funda ingqophamlando yokuhamba okulandelayo kwangempela, hhayi yekheli le-internet elikude. Ikheli elikude ngokuvamile lifinyelelwa ngomzila we-router, ngakho-ke ngeke libe nerekhodi yalo ye-ARP; ukulicela kuyiphutha lesigaba elithumela abantu ukuba bayofuna ingqophamlando engekho obekungafanele ibekhona nhlobo.

Imibiko ekude namaphutha e-UDP angahambisani

I-EHOSTUNREACH ingafika futhi ivela ngaphandle. I-router engakwazi ukudlulisa iphakethe ingathumela i-ICMP host unreachable, futhi i-kernel idlulisela lowo mbiko ku-socket ephethe ukugeleza. Lapho-ke umzila nomakhelwane kulungile, futhi ukwehluleka kungokokuhamba okungaphesheya kwenethiwekhi yasendaweni.

I-UDP yenza kube nzima ukuthola imbangela. Iphutha elibuyiswa ukushaywa kwe-send noma i-receive kamuva lingase libhekisele ku-datagram yangaphambili, ngakho-ke ikheli nesikhathi sokushaywa okwehlulekayo kungase kungafani nephakethe elidale umbiko. I-socket ye-UDP exhunyiwe ithola iphutha kanye, kanti i-socket engaxhunyiwe ingase ingaliboni nhlobo.

Yingakho isikhathi siyingxenye yobufakazi. Bhala ukuthi iphutha lavela nini, i-socket yasebenzisa liphi ikheli le-peer, nokuthi umhubhe wawusanda kuxhuma kabusha. Iqoqo elivela ngokushesha ngemva koshintsho lomzila likhomba ithebula lasendaweni; iphutha elilodwa elivela ngemva kwemizuzu embalwa yokugeleza okuzinzile likhomba umbiko womzila.

Hlukanisa izendlalelo ngaphambi kokushintsha i-crypto

Imibuzo emithathu ihlukanisa iphutha. Ingabe i-kernel ikhethe umzila onqaba indawo okuyiwa kuyo? Ingabe ikhethe umzila ovumelekile kodwa yehluleka ukuxazulula ukuhamba okulandelayo? Noma ingabe umbiko ufike uvela ngaphesheya kwenethiwekhi yasendaweni? Isimo sesithathu kuphela esingathinta ukuphela okukude komhubhe, futhi nakho akuthinti ukubethela.

Izinkinga zokuqinisekisa nokuxoxisana zivela njengamaphutha azo ngemva kokuba ukuthutha kufinyelele ku-peer. Ukushintsha i-cipher noma ukufaka iklayenti kabusha akukwazi ukulungisa umzila we-unreachable wasendaweni, futhi kucekela phansi ubufakazi bomzila nobukamakhelwane obuzowudinga embangeleni yangempela.

Bhala indawo okuyiwa kuyo, i-namespace, ithebula elikhethiwe, ukuhamba okulandelayo, isimo sikamakhelwane nesikhathi sephutha ngaphambi koshintsho lokuqala. Phinda ukusesha okufanayo ngemva kokulungisa; umzila manje okhomba emhubheni kanye nengqophamlando kamakhelwane manje exazululayo kungubufakazi obuqinile kunokuphendula kahle kwe-ping ekhelini elingahlobene.