Ikheli le-peer le-PPP noma iphoyinti lokugcina le-VPN: iliphi eliya ku-via

Umugqa owodwa ku-interface ye-PPP uxazulula ingxenye enkulu yempikiswano yokuhlela emzileni kubhokisi le-VPN: ikheli langaphakathi ne-peer eliphrintwe eceleni kwalo. Funda labo mbili njenge-subnet encane futhi uzobe ufuna isango elingekho. Funda njengeziphetho ezimbili zokuxhumana okukodwa futhi isinyathelo esilandelayo siba sobala. Ukuqhathanisa lapha kuphakathi kwaleyo mifundo emibili, ngoba ithebula ngalinye elakhiwe kamuva lizothola lelo olikhethile. Akukho okumayelana nephoyinti lokugcina le-VPN langaphandle okunqunywa yinoma iliphi kulawo.

Imifundo emibili yomugqa owodwa we-interface

Thatha isikhathi lapho i-interface ibika khona inet 10.64.3.9 peer 10.64.3.1/32. Umfundo we-subnet uthatha i-10.64.3.9 njengomsingathi oyedwa esiqhingini se-/32 bese ifuna i-router ukuze ifinyelele noma yini ngale kwayo. Njengoba ikheli elilodwa kuphela elisele emgqeni kuyi-peer, lowo mfundo ugcina ngokuphakamisa i-10.64.3.9 uqobo njengesango, okuyindilinga.

Umfundo wokugcina uyilowo obhaliwe. Ku-interface ye-point-to-point, peer ibiza isiphetho esikude salokho kuxhumana okukodwa, ngakho i-10.64.3.1 isinyathelo esilandelayo esingasetshenziswa futhi i-10.64.3.9 ihlale iyikheli lomthombo kuphela.

Lowo mehluko ulawula okungavela ku-via. Ukubhala ikheli lendawo lapho kuveza umzila i-kernel engakwazi ukuwuxazulula kumakhelwane, ngakho ukufakwa kwehluleka ukuqinisekiswa noma kugwinya ithrafikhi kuyilapho kubonakala kuphile ngokuphelele ohlwini. I-peer iyasebenza ngoba iyindawo yokwenzeka yangempela emgqeni. Yomibili imifundo iyavumelana ngephoyinti lokugcina le-VPN langaphandle, okuwubunikazi obuhlukile ngokuphelele: kufinyelelwa kulo nge-underlay, hhayi nge-tunnel eliyiqedayo.

Lokho isikhathi esikufakile kakade

Ngaphambi kokubhala noma yiliphi ithebula lakho, phrinta lokho okweza nokuxhumana. Ukuhlanganiswa kwe-PPP okusekelwayo ngokuvamile kufaka umzila wedivayisi nomzila we-peer ngesikhathi sokulungiselela isikhathi, futhi labo bafakwa ababili bavele babhala umfundo olungile.

ip -4 addr show dev ppp0
ip route show dev ppp0
ip route show table main | head -n 5

Umzila wedivayisi ofana ne-10.64.3.1 dev ppp0 proto kernel scope link src 10.64.3.9 awuthwali sango ngoba i-interface uqobo ingumzila. Umzila obiza i-peer nge-via ungenye into enokuphila okunye, futhi unyamalala lapho isikhathi siwa. Ukukopisha enye yalezi zinhlobo ezimbili ethebuleni elihlala njalo ngaphandle kokuhlola ukuthi ifakwa kanjani futhi yisizathu esivamile sokuthi i-tunnel esebenzayo ilahlekelwe umzila wayo ngemva kokuxhuma futhi.

Qhathanisa izinhlu ezimbili esikhundleni sokuthembela enkumbulweni. Uma umzila we-peer ukhona ku-main kodwa ithebula lakho elengeziwe lingenalutho, ufunde okuthile umugqa wekheli ongakaze ukutshele khona.

Umthetho nethebula yizinqumo ezihlukene

Ukukhetha ithebula nokuligcwalisa kuyizinyathelo ezizimele, futhi ukuqhathanisa kubalulekile lapha ngoba lezi zimbili zivame ukudidaniswa ngesikhathi sokulungisa amaphutha. Umthetho othumela ithrafikhi emakwe ithebuleni 100 awenzi lutho uma ithebula 100 lingenawo umzila ohambisanayo, futhi ithebula eligcwele kahle alifinyeleleki uma kungekho mthetho okhomba kulo.

Ingxenye yomzila ozenzakalelayo akuwona umzila ozenzakalelayo. I-0.0.0.0/1 eyodwa ihlanganisa ingxenye engezansi yesikhala se-IPv4, ngakho umgomo ohlose ukubamba konke udinga futhi i-128.0.0.0/1 ehambisanayo, noma i-default yangempela. Ukufunda ukulungiselelwa okusebenzayo nokukopisha enye yezingxenye ezimbili yindlela abantu abagcina ngayo umjikelezo wokuhlela ophuka kuphela ezindaweni ezithile.

Shiya okuhlukile ngamabomu kumakheli okufanele ahlale ku-LAN, futhi unqume ukuthi kwenzekani lapho ukusesha kungatholi lutho ethebuleni elikhethiwe. Umzila wesipele ocacile kulula ukuwucabanga kunethebula elingenalutho, elibuyisela umphumela ongafinyeleleki futhi elenza uhlelo lubonakale luphukile esikhundleni sokuqondiswa kabi.

Buza ukusesha umbuzo obuzwa uhlelo lwakho

ip route get ixazulula umzila; i-ip route show ibala okufakiwe okugciniwe, futhi lezi zimbili zingavumelani ngaphandle kokuthi enye yazo ibe nephutha. Fakisa umongo womthombo, ngoba imithetho esekelwe emthonbeni ihambisana kuphela lapho ukusesha kuthwala umthombo.

ip route get 198.51.100.23 from 10.64.3.9
ip route get 198.51.100.23 from 10.64.3.9 iif ppp0
ip -4 rule show

Umyalo wokuqala ubuza umbuzo kusukela kumsingathi. Owesibili wengeza i-interface yokungena, eseduze nalokho okuhlangenwe ithrafikhi edluliswayo, futhi impendulo ivame ukukhomba ithebula elihlukile. Akukho ndawo yokwenzeka eyisevisi yokuhlola ephilayo; i-198.51.100.23 iyikheli lemibhalo, ngakho ishintshe ngomsingathi ovunyelwe ukuthi uwuhlole.

Ngisho nokusesha okulungile kufakazela kuphela ukuthi kwakhethwa umzila. Akusho lutho mayelana nokuthi uhlangothi olukude luyayamukela yini ithrafikhi noma ukuthi impendulo ingabuya ngokucabanga okufanayo.

Lapho ukuqhathanisa kuphenduka khona

Ithrafikhi yomsingathi nethrafikhi edluliswayo azithathi nje ukusesha okuhlukile; zihlangabezana nezihlungi ezihlukile endleleni yokubuya. I-Linux isebenzisa ukuqinisekiswa komzila ophambene ngokusebenzisa okuqinile kakhulu kwezilungiselelo zayo yonke i-interface ne-interface eyamukelayo, ngakho ukushintsha inani le-interface eyodwa kungase kungabi nawo umphumela obonakalayo. Ukuhlela okusekelwe kuphawu kwengeza ubudlelwano be-src_valid_mark, lapho uphawu kufanele luhambisane ukuze umthombo uthathwe njengovumelekile.

Uma izimpendulo zinyamalala kuyilapho ukuhlela okuphumayo kubonakala kulungile, funda amanani asebenzayo ngaphambi kokuwathinta, futhi uwashintshe kuphela ngesizathu somgomo esishiwo.

sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.ppp0.rp_filter
sysctl net.ipv4.conf.all.src_valid_mark

Khetha phakathi kwemiklamo emibili ngokusekelwe ebufakazini: uma uhlelo lubopha kukheli le-PPP, umthetho womthombo kanye nethebula eliphethe umzila we-peer kwanele. Uma ibhokisi lidlulisela i-LAN engemuva kwalo, udinga futhi ukuthi umongo wokungena nendlela yokubuya kuvumelane. Uma kungavumelani, lungisa ubunikazi bomzila esikhundleni sokukhulula ukuqinisekiswa kwayo yonke imishini.