SSM phezu kwe-OpenVPN: ukulandela umthombo owodwa neqembu elilodwa kusukela ekuqaleni kuze kube sekupheleni

Khetha umfudlana owodwa nomamukeli oyedwa, bese ulandela labo babili kulo lonke igxathu esikhundleni sokuhlola i-multicast njengesigaba. Idizayini eqondene nomthombo yehluleka endaweni eyodwa ngqo kwemine: umamukeli akazange ajoyine, umhleli wemizila wenqaba iphakethe endleleni yokubuya, i-kernel ayinayo imo, noma umhubhe awuzange ulethe ikhophi. Ukusebenza ngalolo hlelo kuthatha amaminithi ambalwa ngegxathu ngayinye futhi kukutshela ukuthi iyiphi kwezine onayo ngempela.

Qala ngokuqinisa umthombo, iqembu nomamukeli

Bhala amanani amathathu ngaphambi kokuthinta noma yisiphi isisetshenziswa: ikheli lomthombo elizothumela, ikheli leqembu umamukeli azokujoyina kulo, kanye nenethiwekhi encane umamukeli akulo. Kumfudlana we-IPv4 oyisibonelo, umthombo ongu-10.50.0.10 neqembu elingu-232.20.30.40 kuwukho okufanele idizayini eqondene nomthombo. Noma yini engacacile kulawo manani amathathu ayikwazi ukuhlolwa.

Ibanga le-232/8 ligcinelwe i-multicast eqondene nomthombo, futhi imodeli ichazwe ku-RFC 4607. Uma iqembu lakho lingaphandle kwalelo banga ngenkathi ucabanga ukuthi usebenzisa i-SSM, yima futhi uqinisekise ukuthi ukusetshenziswa kuhloswe ngempela yini, ngoba ukujoyina komamukeli nesinqumo somhleli wemizila sokudlulisela zombili zincike ekutheni imodeli ihambisana.

Hlola ukuthi umamukeli ujoyine umthombo

Umbiko wobulungu weqembu kuphela awukona ukujoyina okuqondene nomthombo. Buza umamukeli ukuthi ucele muphi umthombo, futhi kumhleli wemizila wegxathu lokuqala bheka isimo seqembu ukuze ubone ukuthi uhlu lwemithombo luyavela yini. Uma umbiko ungathwali mthombo, umhleli wemizila uzowuthatha njengokujoyina okuvela kunoma yimuphi umthombo futhi idizayini yonke izokwehla ngokuthula ibe yinto obungayihlelanga.

Kumamukeli we-Linux, hlola ukuthi isokhethi yabhalisela ini ngempela nokuthi i-kernel yabhala ini. Ifayela lokumisa lohlelo akuwona ubufakazi; ithebula lobulungu lingubufakazi. Lifunde ngesikhathi umamukeli esebenza ngempela, ngoba umbhalo ungahlala isikhashana ngemva kokuphuma kwenqubo owudalile. Umbhalo omdala osuka ekuhlolweni kwangaphambili ungumthombo othembekile wokuzethemba okungelona iqiniso.

ip maddr show dev eth0
cat /proc/net/igmp | sed -n '1,40p'

Uma ukujoyina kukhona nomthombo olindelekile, dabuqa uye kubahleli bemizila. Uma kungekho, akukho kulungiswa komhubhe ozosiza, ngoba akukho okumele kudluliselwe.

Qinisekisa indlela yokubuya ngaphambi kokubheka umhubhe

Ukuhlela kwemizila kwe-multicast kwenza ukuhlolwa kwendlela yokubuya, futhi iphakethe elifika kwenye i-interface ngaphandle kwaleyo okhonjwe umzila we-unicast liyalahlwa. Lesi yisizathu esivame kakhulu sokuthi umfudlana osuthunyelwa ngokucacile awufike neze egxathini elilandelayo, futhi awukhiqizi noma yiliphi iphutha eliwusizo ezingeni lohlelo.

Kumhleli wemizila obheke emthombeni, qhathanisa umzila obheke emthombeni ne-interface okufika kuyo amaphakethe ngempela. Kumhleli wemizila obheke kumamukeli, yenza okufanayo kunethiwekhi encane yomamukeli uqobo futhi uqinisekise ukuthi uhlu lwama-interface aphumayo lufaka isixhumanisi esibheke kuyo. Ukungavumelani kunoma yiluphi uhlangothi ukwehluleka kwe-RPF, hhayi ukwehluleka kobulungu.

Bese uqinisekisa ukuthi i-TTL yomthombo inkulu ngokwanele ukuba idlule amagxathu ahlelwe ngemizila owaklama. Umfudlana osebenza kumhleli wemizila wokuqala bese ufa kwesibili uvame ukuba umbuzo we-TTL hhayi umbuzo wenqubomgomo.

Funda isimo se-multicast se-kernel esikhundleni sokumisa

Ukumisa kukutshela ukuthi wacela ini; i-kernel ikutshela ukuthi kwenzekani. Kuyo yonke igxathu le-Linux, funda imibhalo yokuhlela imizila ye-multicast futhi uqinisekise ukuthi uhlu lwama-interface angenayo naphumayo lukhona kubhangqa eliqondile lomthombo neqembu. Umbhalo weqembu onomthombo ojwayelekile uyinto ehlukile, futhi ngeke uchaze umfudlana oqondene nomthombo.

ip mroute show from 10.50.0.10 iif eth1
ip route get 10.50.0.10

Ama-daemon okuhlela imizila agcina umbono wawo phezu kwaleso simo, futhi umyalo owuphrintayo uncike ekutheni yikuphi ukuqaliswa okufakiwe. Umgomo uhlala unjalo: buza i-daemon ngombhalo wayo ophezulu wabhangqa, bese ubuza i-kernel ukuthi umbhalo wokudlulisela ukhona yini. I-daemon ecabanga ukuthi iyadlulisela ngenkathi i-kernel ingenabo umbhalo iyinkinga yobubanzi bokumisa kuleyo host.

Uma zombili zingavumelani, lungisa i-host hhayi i-VPN. Akukho phansi okungasinxephezela igxathu elingawudlulisi umfudlana owubuzile. Bhala phansi ubhangqa, i-interface engenayo kanye nohlu oluphumayo kuyo yonke igxathu ngesikhathi umfudlana usebenza. Lokho kubhalwa kwenza ukwehluleka okulandelayo kube ukuqhathanisa esikhundleni sophenyo olusha.

Nquma ukuthi umhubhe uphindaphinda kanjani ngempela

Yilapha lapho i-multicast phezu kwe-VPN iyeka ukuba yinto ejwayelekile. Umhubhe wephuzu-kuya-phuzu uletha iphakethe kumlingani oyedwa kuphela ngaphesheya, ngakho ikhophi ifinyelela kuklayenti elilodwa ngqo. Ingxenye eboshwe ngibhuloho iziphatha njengesixhumanisi esabiwe, ngoba umhubhe uthwala uhlaka futhi ibhuloho linquma ukuthi yini ezogcwala. Lawa amamodeli ahlukene okulethwa, futhi idizayini ecabanga owesibili ngenkathi isebenzisa owokuqala izobonakala isebenza kumamukeli oyedwa bese yehluleka kwesilandelayo.

Kumamukeli angaphezu kowodwa ngokusebenzisa iseva enamaphuzu amaningi, ukuphindaphinda kufanele kwakhiwe ngokusobala. Ukufaka umzila we-multicast kugethiwe akukufundisi iseva ye-VPN ukuthi yikuphi okulingana okufanele kuthole ikhophi, futhi akukho mzila ohlangothini lweklayenti owenza leso sinqumo esikhundleni sayo. Lapho isidingo siyimamukeli eminingi, sebenzisa ukuphindaphinda okusekelwayo noma enye indlela ekhethwe ngamabomu, bese ubhala phansi ukuthi ukhethe yiphi.

Ekugcineni, qinisekisa kumamukeli ngaphansi kokubhekwa okuncane: umthombo, iqembu nechwebo eliqondile, ku-interface oyilindele, ngenkathi umamukeli oyedwa ogunyaziwe ejoyinile. I-SSM ikhetha umthumeli, futhi ukukhetha akukona ukuqinisekisa lowo mthumeli, futhi akusona isigunyazo sokuthi ezinye izinto ze-multicast zidlule kuyo leyo nqubomgomo.