Kungani umzila we-VPN ungabonisi gateway kokuphuma kwe-ip route
Umugqa onedivayisi kodwa ongenawo i-gateway uwumzila oqondile, awuwona owephukile. Funda indawo, dev kanye ne-scope, bese uqinisekisa nge-ip route get.
Amathebula okuhamba kwemizila avame ukufundwa njengaphukile njalo lapho ikholomu ye-gateway ingenalutho, nakuba umugqa uvame ukuphelela ngokwawo. Inkambu via ivela kuphela lapho i-kernel inikela iphakethe ekhelini le-hop elandelayo; umzila onamathela ku-interface ufinyelela izindawo zawo ngokuxazululwa kwesendlalelo sokuxhumana noma ngomlingani wephoyinti-kuya-phoyinti. Ukufunda amakholomu ukusuka kwesobunxele kuye kwesokudla kukutshela ukuthi usesimweni sini, futhi lokho kufunda kufanele kwenzeke ngaphambi kokuba noma ubani ahlele umzila ozenzakalelayo. Iningi lamathikithi mayelana ne-gateway engekho liphetha kulowo mehluko.
Funda umugqa womzila ikholomu ngekholomu
Yonke ifayela iqala ngendawo kanye nobude besiqalo sayo, bese yengeza iziguquli ohlwini lwamagama olungaguquki: via, dev, proto, scope, src kanye ne-metric. Umugqa ofana ne-198.51.100.0/24 dev tun0 proto kernel scope link src 198.51.100.2 uminyene kodwa ucacisiwe ngokuphelele. Akukho okushodayo kuwo, futhi akukho khela lomhambisi elisikiselwayo.
Ingxenye ethakazelisayo ukungabikho kwe-via. Ngaphandle kwe-hop elandelayo, i-kernel ixazulula indawo ngqo ku-interface eshiwo, okusho ukuthi kumhubhe ukunikezela ifreyimu kudivayisi yomhubhe bese ukuvaleka kuqhubeka kusukela lapho. I-proto kernel irekhoda ukuthi ifayela lafakwa ngokuzenzakalela lapho kwabelwa ikheli, hhayi ukuthi umphathi wayibhala. I-scope link ithi indawo iyafinyeleleka kulolo xhumano ngaphandle kokudlula kumhambisi, futhi i-src isho ikheli i-kernel ezokhetha njengomthombo wethrafikhi ehambisanayo.
Manje funda umzila ozenzakalelayo ngendlela efanayo: default via 192.0.2.254 dev eth0 proto static metric 100. Lapha i-via ikhona ngoba iphakethe ngempela lidinga i-hop elandelayo, futhi leyondlela kufanele nayo ifinyeleleke ku-eth0. Lemigqa emibili ayizona izinhlobo zomunye komunye; iphendula imibuzo ehlukene mayelana nokuthi ithrafikhi iya kuphi.
Izinhlobo ezimbili zomzila ezididaniswa
Umzila wesizindakheli somhubhe kanye nomzila ozenzakalelayo abukeka efana kusithwebuli sesikrini kodwa benza ngokuhluke ngokuphelele. Sebenzisa ithebula elingezansi njengosizo lokufunda izinkambu, bese uqinisekisa izinombolo zangempela kumshini oyilungisayo esikhundleni sokuthemba isibonelo esivela kumhlahlandlela.
| Piece of the line | What it settles | What it says nothing about |
|---|---|---|
| The destination and mask | Which packets are eligible to match | Where those packets leave the host |
via plus its address | Which next hop receives them, and therefore that a router is involved | Whether that router is reachable or sane |
dev | Which interface carries the encapsulated or raw packet | Whether the interface is up or has a carrier |
proto and scope | Who installed the entry and how far the destination is considered to be | Whether a firewall later drops the traffic |
Into ithebula engakwazi ukuyitshela inhloso. Umzila oqondile oya ebangeni eliyimfihlo ngomhubhe wumklamo wamabomu womhubhe ohlukanisiwe; ukubonakala kwalolo hlobo kumgcini okufanele ithumele konke nge-VPN kuwuphawu. Inhloso ihlala ekuhlelweni okudale ifayela, ngakho bheka ithuluzi eliyifakile ngaphambi kokuphetha ngokuthi i-kernel yenza okuthile okungalungile.
Ngokufanayo, i-gateway engekho akuyona imvume yokuqambela eyodwa. Uma umzila udinga ngempela i-hop elandelayo, leyondlela kufanele ifinyeleleke ku-interface eyithwalayo, futhi kumhubhe wephoyinti-kuya-phoyinti ikheli lomlingani aliyona into efanayo nekheli lendawo. Ukuthatha ikheli lomhubhe lendawo njengomhambisi we-Ethernet kuyindlela evamile yokukhiqiza umzila obonakala ulungile futhi ongadlulisi lutho.
Buza i-kernel ukuthi iyosebenzisa umugqa upi ngempela
Ukufunda ithebula akufani nokwenza usesho, ngoba i-kernel ibonisa imithetho yenqubomgomo, amathebula amaningi kanye namafayela agciniwe ngaphambi kokuphendula. Isenzo esenza usesho lwangempela yi-ip route get, futhi siphrinta umzila iphakethe elinezozimilo elizowuthatha.
ip route get 203.0.113.37 from 198.51.100.2 iif tun0Faka indawo oyikhathazayo ngempela, bese wengeza i-from noma i-iif lapho ithrafikhi ikhethwa ngomthombo noma idluliswa, ngoba usesho lwendawo olujwayelekile lungakhetha indlela ehlukile kuneklayenti elidlulisiwe. Impendulo isho i-interface, ikheli lomthombo elikhethiwe kanye nanoma iyiphi i-hop elandelayo, okuwulwazi olufanayo iphakethe elalizohamba ngalo ngaleso sikhathi.
Uma impendulo ikumangaza, phrinta imithetho ngaphambi kokushintsha noma yini: i-ip -4 rule show iwayisa ngokulandelana kokuqala, futhi iklayenti le-VPN elifaka ithebula lalo noma umthetho wamaphakethe amakiwe ngeke livele neze kuthebula eliyinhloko. Ukubala wonke amathebula kuvala leso sikhala.
ip -4 route show table all | grep -E 'tun|default'Hlola isendlalelo esingaphansi ngaphambi kokushintsha okuzenzakalelayo
Amaphakethe omhubhe ngokwawo kufanele afinyelele iphoyinti lokugcina elikude, futhi akwenza lokho nge-interface yomzimba esebenzisa umzila owawukhona ngaphambi kokuba i-VPN inyuke. Ukushintsha wonke umzila ozenzakalelayo ngaphandle kokubophela leyophoyinti kuthumela amaphakethe avaliwe kuwo kanye umhubhe okufanele bawakhe, futhi uxhumano luwa. Qinisekisa kuqala indlela eya ephoyintini lokugcina ngosesho lwekheli lalowo phoyinti kuphela.
Gcina izinto ezintathu zehlukene lapho wenza ushintsho: umzila oya ephoyintini lokugcina okufanele uhlale ku-interface yomzimba, izigaba eziyimfihlo okufanele zingene kumhubhe, kanye nokuzemzakalelayo okunquma konke okunye. Zihlukanise ngalokho kuhleleka, sebenzisa okukodwa ngesikhathi, bese uphinda usebenzise usesho ngemuva kwesinyathelo ngasinye. I-ping ehlulekayo ngemuva kwalokho ayifakazi okuningi ngokwayo, ngoba izimvume, ukuhamba kwempendulo, i-DNS kanye nesevisi ngokwayo kukhona ngaphansi komzila olungile.
Bhala amanani amane umugqa akupha wona ngaphambi kokuhlela: indawo, i-hop elandelayo noma ukungabikho kwayo, idivayisi, kanye nomthombo okhethiwe. Uma ushintsho lwakamuva lunyakazisa noma yikuphi kuzo, uyazi ukuthi isiphi isinqumo esishintshiwe ngempela, futhi ungabuyisela ifayela elilodwa esikhundleni sokuqagela ithebula lonke.