Ukuhlela i-IPv6 yeziteshi ezimbili ze-WireGuard hub: iphrephiksi, ontanga, imizila
Sebenza nge-hub ye-IPv6 yangasese yama-LAN amabili: khetha iphrephiksi, gcina amakheli wethuneli, bese uvumela i-AllowedIPs ukuthi iveze ukuthi yimuphi ontanga ophethe i-subnet ethile.
Ama-LAN amabili, i-WireGuard hub eyodwa kanye nohlelo lwamakheli e-IPv6 okufanele luphendule imibuzo emithathu ehlukene: iyiphi iphrephiksi, iyiphi ikheli elingeliphi i-router, nokuthi yimuphi ontanga ophethe i-subnet ethile. Uma kukhona okulodwa okungalungile, kuba nethuneli elenza ukuxhawula izandla kodwa lingahambisi lutho. Uhlelo olungezansi luhamba ngokwakhiwa kwangasese kweziteshi ezimbili ngaleyo ndlela. Lwehlile ngamabomu ukunganikezi ukufinyelela kwi-inthanethi nge-IPv6.
Nquma ukuthi iphrephiksi ingeyani
Iphrephiksi yendawo eyingqayizivele evela ku-fd00::/8 iyisinqumo semvelo uma umgomo kuwukufinyeleleka kwangasese phakathi kweziteshi. Ihlala izinze kungakhathaliseki ukuthi iyiphi i-ISP esebenzela indawo ngayinye, futhi ayimemezelwa kuthebula lomhlaba wonke lokuhambisa amakheli, ngakho ayikwazi ukukhiphela izinombolo zakho zangaphakathi ku-inthanethi.
Leyo mpawu efanayo iwumkhawulo. I-ULA ayiniki ndlela yokubuyela emphakathini, ngoba akekho umhlinzeki ophezulu owaziyo ukuthi kufanele iyiswe kwisango lakho. Uma imfuneko ihlanganisa ukuphuma ku-inthanethi nge-IPv6, udinga isabelo esivela kumhlinzeki osihambisa kuwe, futhi lesi yisinqumo sokwakha esihlukile esinosayizi wayo wephrephiksi.
Ungacabangi ukuthi konke ukusetshenziswa kudinga /48. RFC 6177 yasuka ekusayizini eyodwa ephoqelekile yesiza sokugcina, futhi usayizi ofanele ulandela inani lamaxhumano ozowasebenzisa. Dala i-ULA ngenqubo ye-RFC 4193 esikhundleni sokwakha iphrephiksi enye inhlangano engayisebenzisa futhi. Bhala umphumela ohlelweni lwamakheli ngaphambi kokuthi noma yiluphi idivayisi lihlelwe, ngoba iphrephiksi okungekho owayibhalayo iyiphrephiksi ozothi othile ayisebenzise futhi.
Hlukanisa iphrephiksi ngezindima
Isibonelo esingezansi sisebenzisa i-fd7c:2e91:4a00::/48, futhi ithebula lihlelwe ngokuthi yikuphi lapho kubhalwa khona ibhlokhi ngayinye, hhayi ngesiza. Thatha amanani njengesibonelo futhi udale awakho ngaphambi kokuthumela noma yini.
| Where it is written | What appears there | Block used | What it establishes |
|---|---|---|---|
| Hub wg0.conf, interface address | A single host address on the tunnel | fd7c:2e91:4a00:ff00::1/128 | The hub's own tunnel identity |
| Hub wg0.conf, Site A peer | Two ranges in one AllowedIPs line | ::2/128 and :10::/64 | That A owns its tunnel address and its LAN |
| Hub wg0.conf, Site B peer | Two ranges in one AllowedIPs line | ::3/128 and :20::/64 | That B owns its tunnel address and its LAN |
| Site A wg0.conf, interface address | A single host address on the tunnel | fd7c:2e91:4a00:ff00::2/128 | A's identity as the hub sees it |
| Site B wg0.conf, interface address | A single host address on the tunnel | fd7c:2e91:4a00:ff00::3/128 | B's identity as the hub sees it |
Amabhlokhi e-LAN yi-/64 ngoba i-SLAAC ejwayelekile ilindele isikhombisi se-interface se-64-bit. Ukuhlukanisa i-LAN ibe ibhlokhi elincane kwephula leso sisekelo kumahostha amaningi, futhi izindleko zokusebenza azikufanele ukonga kwamakheli ohlelweni lwangasese. Womabili amabhlokhi e-LAN avela maphakathi kwe-/48, okushiya ibanga eliphansi likhululekile eziteshini ezizayo.
Amakheli ethuneli ayisiqu sokugcina sokuphatha, hhayi inethiwekhi ekuxhumaneni. I-interface ngayinye ithola i-/128 eyodwa kuso, ngakho akekho umhosthi ocabanga ukuthi kunesubneti eyabiwe ethunelini futhi ukutholwa komakhelwane akusebenzi lapho kungadingeki. Gcina izindima zihlukene futhi uzibhale ohlelweni lwamakheli lwenhlangano ukuze isiza esizayo singasebenzisi ibhlokhi futhi.
Nikeza i-router ngayinye ikheli elilodwa lethuneli
Yabela i-/128 eyodwa nge-router futhi gcina okhiye kanye namaphoyinti okugcina akhona e-hub esebenzayo. Amanani amathathu angezansi ahluka engxenyeni yomhosthi kuphela.
Hub: Address = fd7c:2e91:4a00:ff00::1/128
Site A: Address = fd7c:2e91:4a00:ff00::2/128
Site B: Address = fd7c:2e91:4a00:ff00::3/128Le-/128 ichaza ikheli elilodwa elabelwe leyo interface. Ayisho lutho mayelana nokuthi ontanga bangahambisa ezingaki izindawo, ngoba ukufinyeleleka kuvezwa ku-AllowedIPs hhayi kuphrephiksi ye-interface.
I-router yesiza ngayinye idinga futhi ikheli ebhlokhini yayo ye-LAN kanye nendlela yokulisabalalisa, ngokuvamile izimemezelo ze-router ze-SLAAC. I-WireGuard ayizithumeli lezo zimemezelo esikhundleni sakho, futhi ayixhumanisi ama-LAN amabili. I-router yesiza iyi-router kuzo zombili izinhlangothi.
Beka ubunikazi besubneti ku-AllowedIPs
Umugqa wontanga we-hub wesiza A unomnikazi wekheli lethuneli lika-A kanye ne-LAN ka-A, futhi labo babili yisitatimende sonke sobunikazi. Akukho okunye kuleso sigaba sontanga okudinga ukuchaza isiza.
AllowedIPs = fd7c:2e91:4a00:ff00::2/128, fd7c:2e91:4a00:10::/64Umugqa wontanga wesiza B unomphela walabo babili abahambisanayo, futhi ukulingana lapha kubaluleke kakhulu kunokuba mfushane. Funda imigqa emibili kanyekanye futhi ukwahlukana kobunikazi kubonakala ngamehlo.
AllowedIPs = fd7c:2e91:4a00:ff00::3/128, fd7c:2e91:4a00:20::/64Lena imigqa emibili ehlukene yontanga, hhayi izinhlu ezimbili ezincintisana ngontanga oyedwa. I-WireGuard isebenzisa i-AllowedIPs kuzo zombili izinhlangothi: ikhetha ontanga wendawo ephumayo, futhi yenqaba iphakethe elingenayo elinomthombo ongahambisani nebanga elabelwe ontanga oyembuleleyo. Ukunikeza wonke u-/48 kobabili ontanga kuzovalela lolo hlolo lwesibili futhi kwenza kungacaci ukuthi yisiphi isiza esiphethe ibhlokhi. Lowo mehluko yiwona owenza ikheli lomthombo elingalungile libonakale esikhundleni sokwamukelwa buthule.
Isiza ngasinye sidinga kuphela izindawo ezifinyeleleka ngontanga waso we-hub: Isiza A sibala ikheli le-hub, ikheli lethuneli lesiza B kanye ne-LAN ka-B, kanti isiza B sibala isethi ephambene. Izinhlu azilingani ngamabomu, ngoba i-router ngayinye ibona uhlangothi oluhlukile lwe-topology. Bhala zombili kusuka ohlelweni lwamakheli hhayi ekuhlelweni kwesinye isiza, ngoba yileyo ndlela ibanga elidala elidlula ekubhalweni kabusha kwezinombolo.
Nge-wg-quick, lawa mabanga akha nemizila. Nge-systemd-networkd noma ukuhlela ngesandla, engeza imizila elinganayo ngokwakho; uma kungenjalo ithuneli lithwala amaphakethe i-kernel engakaze iwathumele kuwo.
Qedela ukudluliswa futhi uhlole izinhlangothi zombili
Nika amandla ukudluliswa kwe-IPv6 ku-hub nakuma-router womabili esiza, futhi uvumele izinsizakalo ezidingekayo phakathi kweziza kumgomo wokudluliswa. Gcina imilayezo ye-ICMPv6 Packet Too Big isebenziseka, ngoba ukuyilahla kwephula ukutholwa kwe-MTU yendlela futhi kwenza ukuma kokudluliswa okukhulu okubonakala njengamaphutha ohlelo lokusebenza. I-hub edlulisa ngaphandle kwemvume yodonga lomlilo ilahla iphakethe phakathi kokuhambisa nethuneli. Le ndlela yokuhluleka ifanele yaziwe, ngoba ithuneli lihlala likhona futhi kufa imithombo embalwa kuphela.
sysctl net.ipv6.conf.all.forwarding
ip -6 route
ping -6 -c 3 fd7c:2e91:4a00:20::1Hlola kusuka kumhosthi esiza A kuye kumhosthi esiza B bese uya ngakolunye uhlangothi. I-ping iya ekhelini lethuneli le-hub ihlola isinyathelo sokuqala kuphela futhi izophumelela ngisho lapho imizila ye-LAN ingalungile. Ukuhamba kusuka kumhosthi kuye kumhosthi yikho okuqinisekisa uhlelo.
Ukuxhumana kwe-WireGuard kwangaphandle kungasebenza phezu kwe-IPv4 ngenkathi ukuhamba kwangaphakathi kuyi-IPv6, futhi lokho kuzimela kuyasiza ngesikhathi sokufuduka. Uma kamuva kunezelwa ukuphuma kwe-IPv6 komhlaba wonke, buyekeza isabelo somhlinzeki, ukukhethwa kwekheli lomthombo kanye nokuhambisa kokubuyela njengesinyathelo esisha sokwakha; uhlelo lwangasese olungenhla luhlala lusemthethweni ekuhambeni phakathi kweziza.