I-OpenVPN ku-PPPoE: yehlisa i-link-mtu, i-tun-mtu noma i-mssfix?

I-ping iyaphendula, i-DNS iyaxazulula, futhi wonke ikhasi elidinga ingxenye egcwele liyahluleka. Kuxhumano olwengeza ukugoqwa kwalo, indlela ilahlekelwa ngokuthula amashumi ambalwa amabhayithi esabelomali, futhi iphrofayela ebhalelwe i-Ethernet ehlanzekile iyaqhubeka icela amaphakethe umugqa ongakwazi ukuwathwala. Uxhumano aluhambi kancane; lushiya ngqo amaphakethe abalulekile.

Izinketho ezintathu zingalungisa lokhu, futhi zisebenza ezingqimbeni ezahlukene. Ukukhetha okungalungile kungenza lutho noma kwenza umhubhe ube buthakathaka ngendlela entsha, ngakho ukukhetha kuqala kulokho indlela eyikusekelayo ngempela.

Amaqhubu amathathu, izingqimba ezintathu ezahlukene

link-mtu isabelomali sangaphandle: umthwalo obethelwe kanye nekhanda le-OpenVPN, ikhanda le-UDP nekhanda le-IP langaphandle. Ichaza okukhishwa umshini, yingakho iyinombolo evinjwa indlela yomzimba.

tun-mtu isabelomali sangaphakathi: isixhumi esibonakalayo esibonwa i-traffic yakho. Sikhulu kunalokho indlela engakuthwala ncamashi ngenani lezindleko zombhede, futhi OpenVPN ivamise ukuyithola ngokwayo esikhundleni sokukuphoqa ukuthi uyisethe.

mssfix iyindlela ehluke ngokuphelele. Ibhala kabusha usayizi omkhulu wengxenye omenywa ngesikhathi sokuxhawula kwe-TCP, ukuze ozakwabo be-TCP bakhethe izingxenye ezilingana ngemva kokugoqwa. Ayishintshi i-MTU yesixhumi, futhi ayinawo umphumela ku-UDP.

Uma usetha link-mtu ngokusobala, i-OpenVPN isusa izindleko zayo ukuze ithole i-MTU yangaphakathi. Lezo zindleko akuzona into engaguquki; zincike ku-cipher nokuqinisekisa, yingakho inani elikopishwe kunkundla lingase libe nephutha kuphrofayela enye. Ukusetha kokubili i-link-mtu ne-tun-mtu kunika iklayenti imiyalelo emibili ephikisanayo.

Kala indlela ngaphambi kokukhetha noma iyiphi inombolo

Kala kusuka kusixhumi somzimba, hhayi ngaphakathi komhubhe, futhi khumbula ukuthi i-ping ibika umthwalo, hhayi usayizi wephakethe. Engeza amabhayithi angu-28 kumakhanda e-IPv4 ne-ICMP ngaphambi kokuqhathanisa umthwalo nefreyimu yamabhayithi angu-1500, futhi ukhumbule lokho kulungiswa uma uzakwabo ebika inombolo ehlukile.

Kuklayenti ye-Linux, i-ping -M do -s 1472 ivimbela ukuhlukaniswa futhi iyehluleka uma iphakethe likhulu kakhulu. Yehlisa umthwalo kuze kudlule, bese wengeza u-28 ukuze uthole i-MTU yendlela. I-PPPoE idla amabhayithi angu-8, ngakho u-1492 ujwayelekile ku-DSL. I-DS-Lite nezinye izindlela zamaselula zidla u-40 noma ngaphezulu, futhi impendulo ivamise ukuba ngaphansi kwalokho okushiwo ijubane lomugqa elibizwayo.

Uma wonke usayizi we-ping uphumelela kodwa ukudluliswa okukhulu kusahluleka, sola umgodi omnyama esikhundleni somkhawulo wosayizi olula. Umlayezo we-ICMP mayelana nokuhlukaniswa okudingekayo uyahlungiwe endaweni ethile endleleni, ngakho umthumeli akakufundi ukunciphisa, futhi imifudlana edinga ingxenye enkulu kuphela eqaphela lokho.

Khawulela i-TCP kuqala, bese unciphisa umhubhe

Ukuxhawula kwe-TCP yikho kuphela okuthintwa i-mssfix, okuivamisa ukwenza ibe isilawuli esiphazamisa kancane kakhulu ukuthi siqale sizanywe. Yisethe kancane ngaphansi kwesabelomali sangempela sendlela, thumela inani elifanayo kusuka kuseva ukuze zombili iziphetho zivumelane, bese uphinda uhlole ukulanda okukhulu. Uma ukuhluleka kunyamalala, inkinga kwakuwusayizi wengxenye ye-TCP, futhi akukho okunye okudinga ukushintshwa.

Yehlisa i-MTU yangaphakathi uma i-traffic ethintekile ingeyona i-TCP. Isevisi ye-UDP, umhubhe ngaphakathi komhubhe noma uhlelo oluthumela ama-datagram anosayizi ogcwele kuzoqhubeka nokuhluleka ngemva komkhawulo we-MSS ngoba akukho okubhala kabusha usayizi wephakethe layo. Yehlisa i-tun-mtu kulelo cala, noma setha i-link-mtu uvumele iklayenti ukuthi ithole inani langaphakathi, kodwa hhayi kokubili nanini.

Ungafinyeleli kunketho endala yokuhlukanisa. Yayihlukanisa amaphakethe ngaphakathi komhubhe, yengeza izindleko, futhi yasuswa ngezizathu ezinhle; i-OpenVPN yesimanje ilindele ukuthi indlela ichazwe ngokunembile.

Kungani izivivinyo ezincane ziqhubeka zisebenza

Imibuzo ye-DNS, imisindo ye-ICMP nokuxhawula kwe-TCP konke kuphansi kakhulu kunosayizi ohlulekayo. Ngakho umhubhe ubonakala uphilile kuzo zonke izivivinyo ezisheshayo ngenkathi ukuxhawula kwe-TLS nezimpendulo ze-HTTP kuhluleka ngokuthula. Yileso sinkathi, i-traceroute esebenzayo nesiphequluli esihluleka ekuphenduleni okukhulu kokuqala, yisibonakaliso okufanele usifune. Finyelela esivivinyweni sosayizi ogcwele ngaphambi kokufinyelela kuphrofayela entsha.

Qinisekisa nge-traffic ehlulekile. Thatha ikhasi elikhulu, thumela i-datagram ye-UDP yosayizi ogcwele uma kuyisevisi ethintekile, futhi uphindele kuklayenti yesibili kuxhumano olunye. Bhala i-MTU yendlela elinganisiwe nenani olikhethile, ngoba uma kungenjalo umuntu olandelayo othinta iphrofayela uzothatha leyo nombolo njengenganakiwe.

Ungalokothi wehlise i-MTU yangaphakathi ngaphansi kuka-1280 uma i-IPv6 ihamba phezu komhubhe, ngoba lokho kuyisilinganiso esincane okumele sixhaswe yilungu ngalinye le-IPv6. I-MTU encane iyiqiniso mayelana nendlela, hhayi isethingi yokusebenza elungiswa ngomuzwa.