Ingabe i-trafikhi ye-IPv6 kufanele idlule nge-VPN noma ngqo?
Nquma ukuthi i-::/0 ingaphakathi komhubhe yini, ngemibandela emithathu: ukusekelwa kokuphuma, ukufinyeleleka kwephoyinti lokugcina kanye namanye amanethiwekhi endawo kuphela.
Ngenyanga edlule abantu ababili bangicela imiphumela ephambene: omunye wayefuna i-IPv6 ihlanganiswe yi-VPN, omunye wayefuna ishicileli sasehhovisi siqhubeke sisebenza. Umzila owodwa ::/0 awukwazi ukunikeza kokubili ngokwawo. Ukuthi lowo mzila ungaphakathi komhubhe yini kuncike emibandeleni emithathu, futhi owokuqala uyikhipha ezindaweni zokuphuma zezentengiselwano eziningi. Uma indawo yokuphuma ingayithwali i-IPv6, ukuqondisa umzila ozenzakalelayo lapho kufihla i-trafikhi yakho kumhubhe ongenandawo yokuyithumela.
Imibandela emithathu inquma impendulo
Umzila ozenzakalelayo uwumugqa owodwa, ::/0, futhi uhambisana nanoma iyiphi indawo ye-IPv6 engenawo umzila oqondile kakhulu (RFC 4291). Ukufaka kwawo kulula. Isinqumo sokuthi kufanele ukwenze yini sihlehlela emibandeleni emithathu.
Umbandela wokuqala: indawo yokuphuma oxhumana nayo inayo i-IPv6 esebenzayo futhi ikulungele ukuyidlulisa. Umbandela wesibili: iklayenti lakho lingagcina indlela eya kumhubhe wokugcina, okuvamise ukuba ngaphakathi kobubanzi ozokuhambisa. Umbandela wesithathu: ungasho izindawo ze-IPv6 zendawo okufanele zihlale zingaphandle komhubhe.
Umbandela ngamunye wehluleka ngendlela yawo, yingakho ukuqagela kuthatha ubusuku bonke. Umbandela wokuqala ohlulekile ukunikeza ukuthula kanye nethebula yomzila ebukeka ilungile. Umbandela wesibili ohlulekile ubulala ukuxhawana ngesandla ngemva kwemizuzwana embalwa kokuqala. Umbandela wesithathu ohlulekile ushiya umhubhe osebenzayo kanye nozakwabo ongeneme eduze kweshicileli.
| What you see | Decision |
|---|---|
| Exit answers IPv6 probes, no local IPv6 devices to protect | Route ::/0 into the tunnel |
| Exit answers IPv6 probes, printer or NAS reachable by a global address | Route ::/0, then give those prefixes a route of their own |
| Exit is IPv4-only inside the tunnel | Do not route ::/0; block IPv6 on the client |
Endpoint is reached over IPv6 and sits inside ::/0 | Install a host route for the endpoint first |
Ingabe indawo yokuphuma iyayithwala ngempela i-IPv6?
Isixhumi somhubhe esinekhasi le-IPv6 asifakazeli lutho ngohlangothi olungaphesheya. Amaphrofayili amaningi ezentengiselwano ane-IPv4 kuphela ngaphakathi: iseva ikunikeza ikhasi le-v4 bese ilahla konke okunye. Faka umzila ozenzakalelayo ovela ku-AllowedIPs phezu kwalokho, futhi umgogodla uzothumela i-IPv6 ngenjabulo kusixhumi esingabonwa umlingani waso.
Hlola kusukela kuklayenti ngenkathi umhubhe uphakeme. ping -6 -c 3 2001:4860:4860::8888 ne-ip -6 route get 2001:4860:4860::8888 ziphendula imibuzo ehlukene: ukuthi impendulo iyabuya yini, nokuthi umgogodla ukhethe idivayisi iphi. Uma eyesibili isho umhubhe wakho kanti eyokuqala ayibuyiseli lutho, inkinga isendaweni yokuphuma, hhayi emzileni.
Uma ugcina indawo yokuphuma ngokwakho, ukuhlolwa kweklayenti kungadlula futhi indlela igcine ngokuphelela endaweni evalekile. Qinisekisa ukuthi i-net.ipv6.conf.all.forwarding=1 ivuliwe kusango futhi udonga lwayo lomlilo lwamukela amaphakethe adluliswa liphuma emhubheni. Iphakethe eliqondiswe kahle liya endaweni yokuphuma eyenqabayo ukudlulisa libukeka njengephutha lokuhambisa lisuka ohlangothini lweklayenti.
Ingabe iklayenti lingagcina indlela yalo eya kumhubhe wokugcina?
Lesi isimo esangibamba kukhompyutha ephathwayo enendawo yokugcina ye-WireGuard eyi-IPv6 kuphela. Ikhasi lendawo yokugcina iyikhasi elijwayelekile lomhlaba, ngakho liwela ngaphakathi kwe-::/0. Qondisa isiqalo sonke kusixhumi, futhi amaphakethe okuxhawana ngesandla azozijaha awo ngokwawo angene emhubheni abasazama ukuwukha. Umhubhe awukhuphuki nakancane, futhi akukho lutho kokuphuma kweklayenti okusho ukuthi kungani.
wg-quick ibhekana nalokhu ku-Linux. Ithola imizila ku-AllowedIPs, iyifaka kwithebula layo, futhi yengeza umthetho wenqubomgomo ukuze i-trafikhi eya endaweni yokugcina ixazululwe kuqala ngethebula eliyinhloko: umthetho suppress_prefixlength 0 owuthola ku-ip -6 rule. Yingakho i-wg-quick up iphumelela lapho i-ip -6 route add default dev wg0 ebhalwe ngesandla ikunqamula khona.
Hlola zombili izimo nge-ip -6 route get <endpoint-v6>, ngaphambi nangemva kokuphakamisa umhubhe. Uma impendulo ishintshela kudivayisi yakho yomhubhe, usususile indlela umhubhe oyidingayo. Uma ubhala imizila ngokwakho, engeza umzila womsingathi oya endaweni yokugcina ngesango lokuqala, noma xhuma endaweni yokugcina nge-IPv4 bese ushiya i-IPv6 emthwalweni.
Yini okufanele ihlale ingaphandle komhubhe?
Imizila eqondile kakhulu yehlula ozenzakalelayo, ngakho isiqalo esisemthini noma ububanzi be-ULA obunomzila waso buqhubeka busebenza ngaphandle komzamo owengeziwe. Lesi isizathu esithulile sokuthi kungani izilungiselelo eziningi ze-IPv4 ezinomhubhe ogcwele zisinda: iziqalo ze-LAN ziqonde kakhulu kunomzila ozenzakalelayo futhi azingeni emhubheni.
Kuyaphuka uma idivayisi yendawo ifinyeleleka ngekhasi lomhlaba, okuyinto ejwayelekile kushicileli esinikezwe isiqalo esivulekile yi-router efanayo, i-NAS noma ithelevishini. Lawo makhasi ahambisana ne-::/0 futhi akukho okunye, ngakho ayathuthela emhubheni kanye nakho konke okunye futhi anyamalale.
Nquma ngendawo oya kuyo, hhayi ngephrothokholi. Uma abasingathi bendawo ababili noma abathathu babalulekile, nikeza iziqalo zabo umzila wokuphuma ngokusebenzisa isixhumi somzimba, noma uzisuse eqoqweni okuxoxiswene ngalo. Uma uhlu luqhubeka lukhula, impendulo eqotho iwukuhlukanisa umhubhe we-IPv6 kanye nohlu olubhaliwe lwezimo ezingafakwanga, hhayi umzila ozenzakalelayo oqhubeka uxazulula.
Uma impendulo ingu-cha, vimba
Ukushiya i-IPv6 ingenamzila akufani nokuyeka ithule. Umsingathi onomzila ozenzakalelayo we-IPv6 osebenzayo uqhubeka uyisebenzisa ngenkathi umhubhe uthwala i-IPv4, ngakho i-trafikhi iphuma eceleni kwe-VPN futhi yonke insizakalo ekhetha i-IPv6 ibona ikhasi lakho langempela. Lokho kuwukuvuza, hhayi umhubhe ohlukanisiwe.
Khetha eyodwa bese ubhala ukuthi ukhethe yiphi. Qondisa ozenzakalelayo bese wamukela izinto ozishintshayo ezingenhla, noma khubaza i-IPv6 isikhathi sonke sokuphila komhubhe. Ukushiya isiqalo ku-AllowedIPs akwanele ngokwako, ngoba uhlelo lokusebenza lugcina okuzenzakalelayo kwalo. Ku-Linux inguqulo eqinile yi-sysctl -w net.ipv6.conf.all.disable_ipv6=1; inguqulo ecijile yakhipha i-IPv6 ngaphandle komhubhe ngomthetho womlilo. Amaklayenti ocingo anesici sokuvimbela i-IPv6 esicacile esenza umsebenzi ofanayo.
Qinisekisa njengokuvuza
Phakamisa umhubhe bese ufunda isimo esikhundleni sokwethemba isici. I-ip -6 route show default kufanele ibonise okuzenzakalelayo okukodwa, futhi i-ip -6 route get endaweni engaphandle kwe-LAN yakho kufanele isho idivayisi yomhubhe. Phinda kokubili ngemva kokunqamuka: umzila ozenzakalelayo ophila isikhathi eside kunomhubhe yiwona phutha obulifuna.
Bese uhlola enye indlela. Kusuka kumsingathi kunethiwekhi yendawo, finyelela iklayenti ekhasini lalo le-IPv6 lendawo. Uma lokho kuyeka ukusebenza, umbandela wesithathu awuzange ugcwaliseke, noma ithebula yomzila yayithini ngaleso sikhathi.
Bhala umphumela lapho umuntu olandelayo ezowuthola khona: yiziphi iziqalo ezihlala zingezendawo, kungani, nokuthi iklayenti lenza ini ngemva kokunqamuka. Imigqa emibili ku-runbook isindisa unjiniyela olandelayo ekuphinde athole umjikelezo wendawo yokugcina phakathi nobusuku.