Ibhuloho le-TAP le-VLAN eyodwa: xhuma i-subinterface

Iklayenti le-TAP elalifinyelela ku-LAN ngaphambi kwama-VLAN futhi lagcina ngemuva kwalokho ngokuvamile lisekhona ibhuloho elisaqukethe i-interface engalungile. Ukudluliswa kwamafreyimu akungezi ithegi ye-VLAN, ngakho ifreyimu yeklayenti engenalo ithegi ethunyelwa ku-uplink yomzimba ifika ingenalo ithegi ku-port ye-trunk futhi ingalahlwa noma iwele ku-VLAN yendabuko. Ukuba khona kwe-subinterface endaweni ethile ku-host akushintshi lutho ohlwini lwamalungu ebhuloho. Leyo iyinsumansumane okufanele iqedwe kuqala: ithegi lifakwa i-interface engumnikazi walo, hhayi ngoba i-host nje inalo.

Ukunwetshwa kwe-VLAN eyodwa kusho isizinda esisodwa sezinga 2, futhi ibhuloho kufanele lijoyine leso sizinda, hhayi i-trunk ethwala zonke.

Ithegi alibonakali ngoba ubhooke i-trunk

Thatha i-uplink ye-Linux eno1 ethwala i-VLAN 120 iye ku-switch ephethwe. Idizayini esebenza ku-VLAN eyodwa iwukuthi tap_vpn ibhookwe ku-br_vpn, kanti i-br_vpn iqukethe i-eno1.120 hhayi i-eno1. I-subinterface ye-VLAN ifaka ithegi lapho iphuma futhi ilisusa lapho ingena, ngakho ibhuloho libona kuphela amafreyimu angenalo ithegi ale-VLAN eyodwa. Esikhundleni salokho faka i-interface yomzimba ebhulohweni, futhi lawo mafreyimu aphuma engenalo ithegi ku-port ye-trunk, okuwukuthi akukho lokho obukuhlelile.

Ukubhooka i-trunk ngenkathi ukuhlunga kwe-VLAN kuvaliwe akuyona indlela emfushane eya emphumeleni ofanayo. Kunikeza ibhuloho yonke i-VLAN ekuleyintambo, kuhlanganise naleyo amaklayenti okungafanele ayibone.

Amadizayini amabili asemthethweni, umnikazi oyedwa wethegi

Ibhuloho elazi i-VLAN liwukuhlelwa okunye okuvumelekile: i-trunk ingena ku-port yebhuloho, futhi ubulungu be-port ngayinye, i-PVID kanye nezilungiselelo zokuphuma ezinethegi kunquma ukuthi yimaphi ama-VLAN adlulayo. Lapho ibhuloho lingumnikazi wokufaka ithegi, futhi ukwengeza i-subinterface ye-VLAN ngaphansi kwalo kungafaka umnikazi wesibili emsebenzini owodwa. Womabili amadizayini ayasebenza; izingcezu zakho kokubili azisebenzi. Nquma ukuthi iyiphi into efaka ithegi ngaphambi kokuhlela noma yiluphi uhlu lwamalungu.

I-port ye-switch kufanele ivumelane nanoma iyiphi idizayini oyikhethayo. I-port ye-access ethwala i-VLAN ingenalo ithegi ihambisana ne-interface yomzimba njengokuxhumana, kanti i-port ye-trunk ihambisana ne-subinterface enethegi. Ukwengeza i-subinterface ku-port ye-access engahambisani akulungisi lutho.

Hambisa ikheli kanye nobulungu

Kudizayini ye-subinterface, ikheli le-host lesubneti ebhookiwe lingele-br_vpn, hhayi i-port ye-VLAN eyenziwe isigqila lapho kungenzeka ukuthi yayihlala khona ngaphambili. Ukuliyeka ku-port kungabonakala kusebenza bese kuziphatha ngendlela eyisimanga, ngoba ibhuloho lidlulisela ezingeni 2 kuyilapho ikheli lihlezi phezu kwelungu. Lihambise njengengxenye yoshintsho lobulungu, hhayi njengocwaningo oluhlukile.

Ukuhambisa ikheli kungasika indlela yokuphatha. Sungula indlela yokubuyisa ezimele, gcina ukucushwa okukhona ngokusebenzisa umphathi wenethiwekhi wokukhipha ngokwawo, futhi ugweme iskripthi sokuqala esiqhudelanayo esizolwa nayo ngemuva kokuthuthukiswa okulandelayo.

Ukunikeza amakheli amaklayenti kudinga ukunakekela okufanayo. I-VPN ebhookiwe ibeka amaklayenti kusubneti enwetshiwe, ngakho iphuli akumele ingenele kwezinye izivumelwano noma izabelo ezingaguquki, futhi ukuhlelwa okuhlinzekwa yi-DHCP kufanele kube yikho okulindelwe ngempela yi-LAN. Indlela esebenzayo yezinga 2 ayisho lutho ngamakheli aphindwe kabili.

Qinisekisa ubulungu ngaphambi kokusola imizila

Funda isimo samanje hhayi leso okuhlosiwe: ip -d link show dev eno1.120 iphrinta i-id ye-VLAN nomzali wayo, ip link show master br_vpn ibala amalungu ebhuloho, futhi bridge vlan show ibika ubulungu be-port ngayinye nokusingathwa kokuphuma. Kudizayini ye-subinterface, qinisekisa ukuthi idivayisi ye-TAP nedivayisi ye-VLAN ngamalungu. Ebhulohweni elazi i-VLAN, hlola inqubomgomo ye-port uqobo, ngoba ibhuloho elikhona alifakazi ukuthi livumela ini.

Bese uhlola iklayenti elilodwa elivunyelwe ngokumelene nensiza ekuleyo VLAN, khumbula ukuthi i-ARP, inqubomgomo ye-firewall kanye nendlela yempendulo kuyizinto ezihlukile kubulungu. Uma ubamba amaphakethe, qaphela ukuthi i-offload yehadiwe ingashintsha lapho amathegi e-VLAN evela khona ku-trace. Gcina nobubanzi buthembekile: iklayenti le-TUN elisetshenziswa ngomzila alibi ilungu le-VLAN nganoma yiluphi ushintsho lwebhuloho, futhi ukuhamba phakathi kwamaklayenti akuthathi indawo yokuxhumeka kwe-host ne-VLAN.