Kungani umzila we-subnet we-Tailscale ogunyaziwe usaqhubeka nokuphelelwa yisikhathi

Ukuvunywa kusikhungo sokuphatha kubonakala njengesinyathelo sokugcina, futhi akusiso. Uhlelo lokusebenza luphelelwa isikhathi kuqala, bese kuba yilapho uthola khona ukuthi umzila uxhunyiwe futhi ugunyaziwe. Ukuvunywa kuyisinyathelo sokusabalalisa, akulona ilungelo futhi akulona isiqinisekiso sokudluliswa. Izigaba ezine kufanele zihambisane ngaphambi kokuba iphakethe lifinyelele kumsingathi ongemuva komzila we-subnet, futhi ngayinye ingaphumelela kuyilapho elandelayo ihluleka. Zihambise ngokulandelana bese uma ezigabeni zokuqala ezingaqinisi.

Izigaba ezine, ukwehluleka okukodwa

Umzila ukhangisa isiqalo, i-tailnet igunyaza lokho kukhangisa, iklayenti lamukela umzila eliwutholile, futhi inqubomgomo yokufinyelela ivumela ukuxhumana okuqondile. Lezi yizinqumo ezine ezihlukene ezenziwe izingxenye ezintathu ezihlukene. Ngakho umzila ogunyaziwe usho kuphela ukuthi inethiwekhi manje iyingxenye yethebula lomzila we-tailnet.

Isigaba sesine yisona esidlulwa kaningi, ngoba ezintathu zokuqala ziletha isimo esibonakalayo. Ilungelo elihlanganisa ikheli le-tailnet lomzila uqobo alihlanganisi ngokuzenzakalela i-subnet eyimfihlo engemuva kwayo. Lezi yizindawo ezihlukene, futhi inqubomgomo ihlolwa ngayinye indawo.

Ku-Linux isigaba sesithathu sinezingodo eziyingxenye esimangaza abantu: ukwamukela imizila ye-subnet kungokuzikhethela. Amaklayenti amaningi e-GUI amukela imizila ekhangisiwe ngokuzenzakalela, ngakho iqembu elixubile lingabonisa umshini oyedwa ohlulekayo kuyilapho amanye esebenza.

Qinisekisa ukulungiselelwa kumsihini ohlulekayo esikhundleni sokucabanga ipulatifomu. Umzila awuzange ube yingxenye engekho emishini esebenzayo, ngakho vumela yona ikhombise ukuthi uhlangothi lwe-tailnet lunempilo. Imibhalo ye-Tailscale mayelana nemizila ye-subnet ihlanganisa ukuvunywa, ukwamukelwa komzila kuklayenti nesigaba senqubomgomo.

Hlola umzila lapho iklayenti lisebenza khona

Qala ngeklayenti elihlulekayo, hhayi ngomzila. Qinisekisa ukuthi umzila ukhona nokuthi ukulungiselelwa kweklayenti kuvumela ukwamukelwa kwemizila.

tailscale status
tailscale debug prefs | grep -i route
ip route get 10.20.0.42

Umyalo wokuqala ukhombisa uhlu lwabalingani nokuthi umzila we-subnet uyafinyeleleka yini, owesibili uprinta izintandokazi zeklayenti kuhlangene nefulegi yokwamukelwa komzila, kanti owesithathu ubuza i-kernel ukuthi isebenzisa isiphi isixhumanisi kumsingathi wangempela ku-subnet. Uma lowo myalo wokugcina usho isixhumanisi somzimba esikhundleni sesixhumanisi se-Tailscale, umzila awuzange ungene ethebuleni. Umzila ongekho uyinkinga yohlangothi lweklayenti, hhayi inkinga yokuvunywa. Yilungise ngaphambi kokubheka inqubomgomo.

Ukuze wamukele imizila ku-Linux, xhuma kabusha nefulegi esikhundleni sokucabanga ukuthi isethiwe: tailscale up --accept-routes. Iklayenti elijoyine namanye amafulegi liwagcina kuze kube yilapho eshintshwa, ngakho hlola ukulungiselelwa kwamanje ngaphambi kokwengeza okunye. Ukuphinda kusetshenziswe umyalo wokuqala ngemva koshintsho kufanele kukhombise umzila ethebuleni.

Khombisa ukudluliswa nendlela yokubuya

Ukuvunywa akukulungiseleli umzila ukudlulisa amaphakethe, futhi akuhleli impendulo. Kokubili izindaba zezinga lomsingathi ohlangothini lwe-LAN lomzila. Zihlole emzileni, hhayi kuklayenti.

sysctl net.ipv4.ip_forward
iptables -t nat -L POSTROUTING -n -v
tcpdump -ni any host 10.20.0.42 and port 443

Umyalo wokuqala kufanele ubike 1, ngaphandle kwalokho i-kernel izolahla iphakethe elidlulisiwe. Owesibili ukhombisa ukuthi ukufihla komzila we-subnet kubhala kabusha umthombo yini, okuwukuziphatha okuyizingxenye futhi ngokuvamile okuyikho okufunayo. Owesithathu ukhombisa ukuthi isicelo siyafinyelela yini endaweni esiya kuyo nokuthi kukhona okubuyayo yini; isicelo esingenampendulo siyinkinga yendlela yokubuya, hhayi inkinga yokuvunywa. Funda imiphumela emithathu ndawonye ngaphambi kokushintsha noma yimuphi wayo.

Uma ukufihla kucishiwe, inethiwekhi yendawo esiya kuyo idinga umzila obuyela emakhelini e-tailnet, futhi yonke ingxenye esendleleni kufanele ikwazi lokho. Ukuvula kabusha ukufihla kuyisixazululo esisheshayo sesevisi eyodwa, kodwa ngezindleko zokufihla ikheli lokuqala leklayenti endaweni esiya kuyo. Lokho kushintshana kubalulekile lapho indawo esiya kuyo irekhoda amakheli omsuka ukuze kuhlolwe, ngakho nxephezela ngamabomu esikhundleni sokuphendula ifulegi phakathi kwesigameko. Bhala phansi ukuthi ukhethe ini, ngoba umuntu olandelayo uzobona okukodwa kwezinto ezimbili zokuziphatha.

Funda umthetho wokufinyelela wensiza

Uma umzila ukhona futhi ukudluliswa sekukhombisiwe, umsolwa osele inqubomgomo. Funda ilungelo okufanele livumele ukuxhumana bese uhlola indawo eliya kuyo, hhayi umthombo kuphela. Ubunikazi beklayenti uqobo kufanele futhi buhambisane nesikhethi senqubomgomo, ngakho kubhale kusuka kumsihini ofanayo ohlulekayo.

tailscale status --json | head -40
tailscale ping <router-name-or-tailnet-ip>
ping -c 3 10.20.0.42

Umphumela wesimo ukhomba amakheli eklayenti uqobo nabalingani elibabonayo, futhi isikhethi somsuka senqubomgomo kufanele sihambisane nakho. tailscale ping kukhombisa indlela ye-tailnet kuze kufike kumzila we-subnet uqobo; ixazulula amagama abalingani namakheli e-tailnet, hhayi abasingathi ngaphakathi kwe-subnet ekhangisiwe. Umyalo wesithathu uthumela umsindo we-ICMP ojwayelekile ngomzila we-subnet, ngakho umphumela wawo uchaza indawo esiya kuyo hhayi umzila. Ukwenqatshwa kwezinga le-tailnet ngokuvamile kubuya njengokwenqatshwa, kuyilapho iphakethe eliphumayo futhi elingabuyi liphelelwa isikhathi.

Igama elihlulekayo liwumbuzo ohlukile kunekheli elihlulekayo; xazulula umsingathi ngqo ngaphambi kokusola umzila. Bhala ilungelo ngokuvumelana nesidingo sangempela sensiza, hhayi i-subnet yonke. Ukuvula i-/24 yonke ukuze uhlelo olulodwa lusebenze yiyo indlela isicelo esincane esiba ilungelo elibanzi okungabikho muntu oyike ukulisusa ngemuva kwalokho.

Uma inhloso kwakuwukuphuma ku-inthanethi hhayi i-subnet eyimfihlo, ingxenye efanele iyindawo yokuphuma, hhayi umzila we-subnet, futhi inqubomgomo nokuhamba komzila kuyahluka ngokufanele. Hlola leso sinqumo ngaphambi kokwandisa ilungelo. Indawo yokuphuma ishintsha umzila oyizingxenye; umzila we-subnet ukhangisa isiqalo kuphela.