Ama-hop amabili e-VPN ku-Pi eyodwa: iyiphi indlela ethwala umlingani muni
Amakheli amabili omhubhe ku-Pi eyodwa akulona iphutha. Indawo ngayinye idinga umthwali wayo, ubufakazi bayo kanye necebo elisekelo elimenyezelwe lapho i-hop yangaphandle ifa.
Amakheli amabili omhubhe ebhodini elincane abonakala njengephutha, futhi ukusabela okuvamile ukususa elilodwa. Lokho kusabela kuphula into okwakufanele kuyilungise. Umethuli othwala ama-hop amabili ugcina ikheli elilodwa ngoxhumano ngalunye, futhi ikheli ngalinye likhethwa indlela ehlukile. Umbuzo ofanele ubuze ukuthi iyiphi indlela ekhetha umthwali muni wendawo muni, hhayi ukuthi mangaki amakheli akhona.
Izindawo ezintathu ezidinga abathwali abahlukene
Uchungechunge lwama-hop amabili yizigaba ezintathu zendawo ezibekwe phezu komunye, futhi ngayinye ithwalwa uxhumano oluhlukile. Umlingani wangaphandle kufanele afinyelelwe ngoxhumo lwangempela. Umlingani wangaphakathi kufanele afinyelelwe ngomhubhe wangaphandle. Indawo yohlelo olumboziwe kufanele ifinyelelwe ngomhubhe wangaphakathi, okuthi ukuthutha kwawo kuthwalwe nguwangaphandle.
| Destination class | View that names the carrier | Command that proves it | Symptom when the wrong carrier wins |
|---|---|---|---|
| Outer peer, 198.51.100.10 | the main table, by destination | ip route get 198.51.100.10 | the outer handshake never completes |
| Inner peer, 203.0.113.7 | the main table once the outer tunnel is up | ip route get 203.0.113.7 | the inner handshake leaves over the physical link |
| Application destination, 172.30.9.1 | the table the inner client's traffic is selected into | ip route get 172.30.9.1 from 10.8.0.2 | the exit address looks right and the traffic never crossed the outer hop |
| Parallel tunnels, one per source group | one policy per group, not the main table | ip rule show beside a marked test connection | both tunnels are up and one steals the other's traffic |
Gcwalisa imigqa ngamakheli angempela omfundi ngaphambi kokuthinta indlela, ngoba ithebula liwusizo kuphela uma licacile. Uchungechunge olusebenzayo lwanelisa yonke imigqa emine ngesikhathi esisodwa, kanti uchungechunge olusebenza ingxenye luvamise ukwanelisa owodwa wabo ngomthwali ongafanele. Ukufunda umugqa ongafanele njengephutha yikho okuguqula inkinga yokuhambisa amapaki ibe usuku lonke lokuhlela.
Amakheli anezindima, hhayi inani
I-Linux ivumela amakheli amaningi kuyi-interface eyodwa namahubhe amaningi kumethuli oyedwa, ngakho inani alisho lutho mayelana nokunemba. Okubalulekile ukuthi yiliphi ikheli elingeliphi uxhumano, nokuthi indlela yomlingani othile ikhetha uxhumano obeluyikho. Izibono ezintathu ziphendula lokho zisuka ezinhlangothini ezintathu, futhi kufanele zifundwe ngokulandelana okufanayo njalo.
Uhlu lwamakheli lukhombisa ukuthi yini ekhona nokuthi yiluphi uxhumano olunayo. Ithebula lezindlela liphendula umbuzo womthwali wokuhamba okujwayelekile kwendawo. Isibono senqubomgomo siphendula futhi ngokuhamba okukhethwe ngomthombo noma uphawu, okuyilungiselelo elijwayelekile lapho amaklayenti amabili abelana ngumethuli oyedwa.
ip -4 addr show
ip -4 route show table all
ip rule showUkususa ikheli ngoba uhlu lubukeka lulude kungase kususe ingxenye yendlela, futhi ukususa indlela ngoba ibukeka iyisengezo kwenza okufanayo ngokuthula kakhulu. Kokubili akukhiqizi iphutha; umlingani uvele ayeke ukuphendula endleleni obekuyiyo, kuyilapho esafinyeleleka ngenye. Uhlelo olubika ikheli lokuphuma lomlingani wangaphakathi alufakazisi ukuthi ukuhamba kwadlula umhubhe wangaphandle, ngoba ukufinyelela okuqondile kunikeza umbono ofanayo. Yilelo gebe phakathi kombono nobufakazi eliyisizathu sokuthi umthwali uhlolwe kusendlalelo sokuhambisa.
Ukulandelana kokwenza kweqa ukulinda okungaguquki
Uma iklayenti langaphakathi lincike ekhelini noma endleleni enikezwa yiklayenti langaphandle, ukwenza kufanele kulinde leyo nsiza hhayi ukubambezeleka. Ukulinda kusebenza kuze kufike usuku lapho umhubhe wangaphandle unensa khona, bese kwehluleka ngezikhathi ezithile ngendlela okungekho ongayiphinda. Ukulandelana okusekelwe ekuncikeni kususa ukuqagela futhi akubizi lutho ngaphandle kokuchaza ukuncika kanye. Amagama e-interface nawo awasona isu lokulandelana.
I-kernel inikeza amagama afana ne-tun0 ne-tun1 ngokulandelana kokudalwa, futhi lokho kulandelana kungashintsha phakathi kokuqalisa kabusha noma ukuxhuma kabusha. Hlanganisa ukuhleleka nobunikazi obunikezwa ithuluzi, noma negama olisinikeza ngamabomu. Igama olikhethayo yisivumelwano; igama elikhethwa i-kernel yingozi.
Gcina ukuthutha kweklayenti ngalinye ngaphandle kwendlela yohlelo yelinye, futhi ube nembe eqinile mayelana nalokho izinketho zokuhambisa ze-OpenVPN 2.6 ezikuthembisa ngempela. Indlela yokuqondisa kabusha emisiwe ebhalwe phansi igcina iklayenti likwazi ukufinyelela umlingani walo okude ngokusebenzisa isango elalivele likhona, futhi lokho kunqamula umjikelezo owodwa othile wokuphindaphinda. Akwenzi iklayenti elilodwa libe umthwali welinye, ngakho ingxenye esele yochungechunge ihlala ingumklamo wakho. Lapho uchungechunge ludinga inqubomgomo hhayi indlela, bhala umthetho ocacile womthombo noma uphawu futhi uwuhlole ngokuhamba okufanele kuhambisane nakho.
Kwenzekani lapho i-hop yangaphandle ifa
Ngaphambi kokuthi uchungechunge lubhekwe njengoluphelele, ncika ukuthi kwenzekani lapho i-hop yangaphandle inyamalala. Ukuthutha kweklayenti langaphakathi kufa kanye nayo, futhi isinyathelo esilandelayo umbuzo wenqubomgomo hhayi wobuchwepheshe: ukwehluleka, ukuzama futhi, noma ukuxhuma kabusha ngqo ngoxhumo lwangempela. Umphumela wesithathu yiwo ofanele ucatshangelwe. Uguqula buthule umklamo wama-hop amabili ube umklamo we-hop eyodwa ngesikhathi umsebenzisi ekholelwa ukuthi ukumboza kusaphelele.
Uma ama-hop amabili ephoqelekile, iklayenti langaphakathi akufanele likwazi ukwakha indlela eqondile lapho elangaphandle lingekho, futhi indlela yokwazi ukwephula i-hop yangaphandle nokubuka okwenziwa elangaphakathi. Icebo elisekelo eligunyaziwe liyimpendulo esemthethweni, kodwa kufanele libhalwe phansi, lihlolwe futhi laziswe. Icebo elisekelo okungekho owayebhala phansi ngeke lehlukaniswe nokuvuza ngesikhathi sokubuyekezwa kwesigameko.
I-DNS nomunye umndeni wamakheli kuyingxenye yesinqumo esifanayo. Ukusesha okukhiqizwe endaweni kulandela inqubomgomo yomethuli uqobo hhayi eyeklayenti elidlulisiwe, ngakho isixazululi esisebenza ekuhambeni okudlulisiwe kungenzeka kungabi yiso esisetshenziswa umethuli uqobo.
Yamukela isendlalelo ngasinye ngokulandelana owasakha ngakho
Hlola ngokulandelana okwakhiwe ngakho uchungechunge: okokuqala umhubhe wangaphandle uwodwa, bese kuba ukuthutha kweklayenti langaphakathi ngomhubhe wangaphandle, bese kuba uhlelo ngomhubhe wangaphakathi. Ukwamukelwa ngakunye kufanele kube uxhumano olusha hhayi ikhasi elalivele livuliwe. Bese uphula futhi ubuyisele isendlalelo ngasinye ngokwehlukana futhi ubuke okwenziwa esilandelayo.
Umphumela wecebo elisekelo uwumbono obaluleke kakhulu lapha, futhi yilowo ikhasi le-IP lomphakathi elingalokothi liwukhombise. Gcina izindlela zomlingani, amakheli azisebenzisayo kanye nalowo mphumela eduze kokuhleleka, ngoba indlela enhle akuyona ingxenye ebuzwa ngayo kamuva.