Izinganekwane ze-MTU ku-VPN: kungani amaphakethe akho encipha nokuthi isikhala siyaphi

Omunye ukutshela ukuthi i-VPN "ilahlekelwa amaphakethe ngenxa ye-MTU", ubeka umhubhe ku-1400, futhi ukudluliswa kuyasebenza futhi. Lowo mphumela uzwa sengathi wukuxilongwa. Ngokuvamile kuwukuqondana kwezibalo: ukhethe inombolo encane ngokwanele ukuba ingene ngaphansi komkhawulo ongakaze uwubone, futhi uzophinde uhlangane nawo lowo mkhawulo kunethiwekhi elandelayo enesabelomali esihlukile.

Izindaba eziqanjiwe ezimbili zibangela iningi lalokhu. Eyokuqala ukuthi i-MTU yesixhumi somhubhe iyi-MTU yendlela. Eyesibili ukuthi ukufaka ngaphakathi kubiza "isihloko esisodwa" futhi i-PPPoE ayibizi lutho okufanele kubalwe. Zombili azilungile ngendlela eyenza inombolo oyikhethile ibonakale ingenasizathu kuyilapho empeleni inqunyiwe.

Indaba yokuqala: i-MTU yomhubhe iyi-MTU yendlela

Inani olibeka kusixhumi somhubhe liyisithembiso sasendaweni mayelana nephakethe langaphakathi elikhulu kakhulu ukuqaliswa okuzolidlulisela phansi. Umthamo wangempela wendlela uyisici sawo wonke isixhumanisi phakathi kwakho nomphetho okude, futhi ungashintsha lapho indlela ishintsha, lapho uxhumano lweselula ludluliselwa, noma lapho ithrafikhi ithatha enye i-peering. I-1500 ebekiwe ikutshela ukuthi isiphetho sakho sizokwakha ini, hhayi ukuthi inethiwekhi izothwala ini.

Ukutholwa kwe-MTU yendlela kukhona ukuze kuhlanganiswe kokubili, futhi kuncike empendulweni. Ku-IPv4, umhambisi ongakwazi ukudlulisa iphakethe elingosayizi ogcwele kufanele athumele umlayezo we-ICMP "fragmentation needed", futhi umthumeli wehlisa isilinganiso sakhe. Ku-IPv6, okulingana nakho umlayezo we-Packet Too Big, futhi abahambisi abahlukanisi nhlobo phakathi nendlela. Lapho leyo mpendulo ihlungiwe, umthumeli uqhubeka nokukhiqiza amaphakethe indlela engakwazi ukuwathwala, futhi akukho okumtshela ukuthi kungani.

Indaba yesibili: ukufaka ngaphakathi kubiza isihloko esisodwa

Bala izingqimba zangaphandle ngobuqotho. Isihloko se-IP sangaphandle singamabhayithi angu-20 ku-IPv4 noma angu-40 ku-IPv6. Ukufaka i-UDP ukuze kudlule i-NAT kuneza okungu-8. Iphrothokholi yomhubhe yeneza isihloko sayo, i-vector yokuqala noma i-nonce, ukugcwalisa kuze kufinyelele umkhawulo webhlokhi noma wokuqondanisa kombhalo, ingxenye yokugcina kanye nenani lokuhlola ubuqotho. Kuye ngephrothokholi nombhalo, isamba sihlala ngokukhululeka emashumini amabhayithi ngaphambi kokuba iphakethe langaphakathi liqale.

Bese ususa futhi izihloko zephakethe langaphakathi ngokwalo. Ingxenye ye-TCP ngaphakathi komhubhe ithwala isihloko sayo se-IP samabhayithi angu-20 kanye nesihloko se-TCP samabhayithi angu-20, futhi i-MSS ye-TCP isuselwa ku-MTU, hhayi kumthwalo wamagama omhubhe. Yingakho i-ping ngomthwalo omncane ingaphumelela kuyilapho ukudluliswa kwefayela kuma: amathuluzi ahlola izinto ezihlukile, futhi lilodwa kuphela kuwo elisebenzisa ingxenye ye-TCP yosayizi ogcwele.

ip link show tun0
ping -M do -s 1472 192.0.2.10
ping -M do -s 1400 192.0.2.10

Umyalo wokuqala ubika i-MTU yomhubhe ebekiwe. Izivivinyo ezimbili zithumela umthwalo wamabhayithi angu-1472, okukanye nezihloko ze-IPv4 ne-ICMP zamabhayithi angu-28 kuyiphakethe lamabhayithi angu-1500, bese kuba elincane. Uma isivivinyo esikhulu sehluleka ngokuphelele futhi esincane siphumelela, unenkinga encike kosayizi, hhayi inkinga evamile yokuhamba kwendlela.

Indaba yesithathu: i-PPPoE isakunikeza i-1500 ehlanzekile

Isixhumanisi sokungena se-PPPoE esivamile asithwali iphakethe le-IP lamabhayithi angu-1500. Isihloko se-PPPoE kanye nensimu yephrothokholi ye-PPP kuthatha amabhayithi angu-8 ngaphakathi kohlaka lwe-Ethernet, okushiya ama-1492 ephakethe le-IP. Lowo umkhawulo wendabuko ochazwe ku-RFC 2516. Uma ugijima i-VPN phezu kwesixhumanisi esinjalo, izindleko ezengeziwe zomhubhe zivela kulawo ma-1492, hhayi ku-1500.

I-RFC 4638 ichaza indlela yokuxoxisana ngomthwalo we-PPP omkhulu lapho kokubili isihlanganisi sokungena kanye nemishini yeklayenti kusekela, yingakho "luxhumano lusebenzisa i-PPPoE" lodwa alufakazeli inombolo ethile. Isilungiselelo sendawo asikwazi ukuphoqa idivayisi ephakathi ukuthi yamukele iphakethe engakaze ilungiselelwe lona, ngakho umbuzo owusizo ukuthi isixhumanisi saxoxisana ngani ngempela, hhayi ukuthi ilebula ithini.

Kungani ukwehluleka kubonakala kukhethiwe

Ukuthi izicelo ezincane ziphumelela futhi ukudluliswa okukhulu kuma wuphawu olujwayelekile lomgodi omnyama we-MTU yendlela. Ukuxhawula, umbuzo we-DNS kanye nocingo lwe-API konke kungena; ukudluliswa okukhulu kukhiqiza izingxenye zosayizi ogcwele ezifela kusixhumanisi esisodwa, futhi umlayezo we-ICMP obekufanele ubike inkinga awufiki nakancane. Uxhumano lubonakala lulungile futhi ukulanda kulenga, okwenza abantu babheke iseva esikhundleni sendlela.

Iphutha lesibili, elihlobene, ukuhlanganisa izinombolo ezintathu: i-MTU yesixhumi, i-MSS ye-TCP kanye nesilungiselelo sephrothokholi siqu sokuhlukanisa noma sokugcwalisa. Ukucindezela kwe-MSS kumhambisi kubhala kabusha i-MSS emenyezelwe ukuze umthumeli akhe izingxenye ezincane; akushintshi i-MTU yomhubhe futhi akusizi ithrafikhi ye-UDP. Ukunikeza zontathu inombolo efanayo ngoba zibonakala zihlobene yindlela ushintsho olunenhloso enhle olubhidliza ngayo isethaphu esisebenzayo.

Yini okufanele ishintshwe, futhi ngaluphi ukulandelana

Qala ngobufakazi. Qinisekisa ngezivivinyo ezingenhla ukuthi inkinga incike kosayizi, bese thola usayizi omncane kakhulu odlulayo nomkhulu kakhulu ohlulekayo. Hlola i-MTU yangempela yesixhumanisi sokungena ngaphambi kokusola umhubhe; isixhumanisi se-PPPoE sinciphisa isabelomali ngaphambi kokuba i-VPN yakho sisithinte. Bhala phansi amanani okuqala ukuze ushintsho lubuyiselwe.

Bese usebenzisa ukulungiswa okuncane kakhulu okubhalwe yiklayenti. Amaklayenti amaningi anikeza i-MTU yomhubhe kanye nokukhetha kokulungisa i-MSS, futhi ukukhetha kwe-MSS ngokuvamile kuyisigxobo esingcono se-TCP ngoba kufinyelela kumthumeli ngaphandle kokunciphisa iphakethe ngalinye. Hlola futhi iwona lowo mkhondo nokudluliswa okufanayo, futhi bhala phansi izinombolo oze wazikhomisa kuzo. Inani lomhubhe elisebenza kunethiwekhi eyodwa yokungena akuyona ingunaphakade yomhlaba wonke, futhi indawo elandelayo izoba nesabelomali sayo.