Inodi yokuphuma ye-ZeroTier ayisebenzi? Hlola umzila, i-NAT kanye neklayenti
Umzila we-0.0.0.0/0 kuklayenti awuwona ukuphuma. Inodi kufanele idlulise futhi ihumushe, inethiwekhi kufanele imemezele umzila, futhi iklayenti kufanele iwamukele.
Ithebula lemizila likhombisa umzila ozenzakalelayo ngokusebenzisa isixhumi se-ZeroTier, inethiwekhi ibika ukuthi iku-inthanethi, futhi isiphequluli sisaphuma ngedilesi ye-ISP yasendaweni. Le nhlanganisela ivamile futhi akulona iphutha leklayenti. Umzila ozenzakalelayo usho kuphela ukuthi amaphakethe kufanele aye kuphi; kufanele kube khona okuthile okudlulisayo nokuhumushayo ngakolunye uhlangothi. Izingxenye ezintathu ezihlukene kufanele zibe yiqiniso ngaphambi kokuba inodi yokuphuma isebenze.
Umzila ukhona kodwa akukho okukhayo
Qala ngokuhlola ithebula lemizila yeklayenti. Umugqa ofana ne-default via 10.147.20.5 dev zt0 ufakazela ukuthi umzila ufakiwe, hhayi ukuthi indawo ekuhloswe kuyo izokwamukela ukuhamba. Ukweqa okulandelayo kufanele kube yilungu elizimisele futhi elikwazi ukuwudlulisa.
Uma isicelo esifanayo sisaphuma ngokusebenzisa isixhumi esibonakalayo, iklayenti ayizange iwufake umzila, noma iwufake ngesilinganiso esahlulwa umzila ozenzakalelayo wasendaweni. Uma isicelo sinyamalala ngemuva kokufakwa komzila, ilungu lokuphuma liyamukela amaphakethe kodwa liyehluleka ukuwadlulisa noma ukuwuhumusha. Iklayenti egcina umzila ozenzakalelayo obonakalayo ayithumeli nephakethe elilodwa kokuphuma.
Umehluko lowo unquma ukuthi kufanele kusetshenzwe kuphi. Ukuqhathanisa ikheli lomphakathi ngaphambi nangemuva koshintsho kuhlukanisa umzila ongakaze usetshenziswe kanye nalowo osetshenzisiwe wabe ulahliwe, futhi kudinga umyalo owodwa esikhundleni sokubuyekeza konke ukulungiselelwa. Yenza ukuqhathanisa ngaphambi kokushintsha noma yini enye, ukuze imiphumela yomibili ivele esimweni sokuqala esifanayo.
Izingxenye ezintathu okufanele zibe yiqiniso zonke
Ukuphuma kuyikhethe, futhi isixhumanisi esibuthakathaka kunazo zonke sinquma uphawu. Ithebula elingezansi libala izixhumanisi ngokulandelana okuvamile ukwehluleka kuzo.
| Part | Where it lives | What a failure looks like |
|---|---|---|
| Forwarding and NAT | Exit node kernel and firewall | Traffic arrives, no reply |
| Managed default route | ZeroTier network controller | No default via the tunnel on the member |
| Client acceptance | Member's per-network setting | Route offered but not installed |
| DNS behavior | Client resolver configuration | Pages fail by name, IP works |
Umugqa wokuqala yilowo ogqitshwa yigama lenketho. Ilungu liba ukuphuma kuphela lapho umgogodla walo udlulisa amaphakethe phakathi kwesixhumi se-ZeroTier nesixhumi esibheke kwi-inthanethi, noma lapho indlela yokuphendula ihumushwa ibuyela emhubheni. Ngaphandle kwalokho kudlulisa, ilungu lingumlingani, hhayi isango.
Umugqa wesilawuli ugunyazo, hhayi ukulungiselelwa. Ukumemezela 0.0.0.0/0 ngokusebenzisa ilungu kutshela iklayenti ngayinye ukuthi ukuphuma kukuphi; lokho akwenzi lelo lungu likwazi ukuthwala ukuhamba. Futhi akutusi ukuthi ilungu linomzila osebenzayo oya kwi-inthanethi. Imibhalo ye-ZeroTier ngenodi yokuphuma ihlanganisa ukuhlukaniswa okufanayo phakathi kwenodi, umzila neklayenti.
Lungiselela inodi yokuphuma ukudlulisa nokuhumusha
Nika amandla ukudlulisa kwe-IPv4 ngokuqhubekayo, bese ufaka i-NAT yomthombo wokuhamba okuphuma kusixhumi se-WAN. Imithetho yokuhlunga kufanele ivumele ukugeleza okudlulisiwe ezinhlangothini zombili, ngoba ukudlulisa nokuhumusha kuhlukile emvumweni:
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i zt0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o zt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTFaka esikhundleni se-zt0 ne-eth0 amagama akumgangatho; umthetho ogcinelwe isixhumi esiyisibonelo awulandeli amaphakethe kusixhumi sangempela. Yenza izinguquko zibe ngokwaphakade ngokusebenzisa umphathi wothango lomlilo ophethe imithetho, ngoba umyalo kugobongo olusebenzisanayo unyamalala ekubuyiseleni okulandelayo.
Uma umgangatho usebenzisa umphathi wothango lomlilo ofana ne-UFW noma i-firewalld, faka imithetho ngokusebenzisa lowo mphathi esikhundleni sokuqongelela imigqa ye-iptables eceleni. Abanikazi ababili abahlela imigqa efanayo bakha inqubomgomo encike ekulandeleni kokuqala. Ukulandelana kubalulekile lapho umphathi ekhiqiza imigqa yawo. Hlola kusuka kuklayenti ngemuva kokulayisha kabusha umphathi, hhayi ngaphambi.
Memezela umzila futhi uwamukele kuklayenti
Kusilawuli senethiwekhi faka umzila ophethwe we-0.0.0.0/0 okweqa kwalo okulandelayo kuyikheli le-ZeroTier lelungu lokuphuma. Bese kuyilungu okufanele liwusebenzise, vumela ukushintshwa kwaleyo nethiwekhi. Imvume yasendaweni: ayilungiseleli amanye amalungu futhi ayishintshi isilawuli.
zerotier-cli listnetworks
zerotier-cli set <network-id> allowDefault=1
ip route get 1.1.1.1Umyalo wokugcina kufanele ubike isixhumi se-ZeroTier nekheli lelungu lokuphuma. Uma usabika isixhumi esibonakalayo, umzila awukho noma umzila ozenzakalelayo oyimbangi unesilinganiso esingcono.
Gcina ukulungiselelwa kukhawulelwe kunethiwekhi eyidingayo. Ukunika amandla ukwamukelwa komzila ozenzakalelayo emhlabeni wonke, noma kunethiwekhi okufanele inikeze kuphela isethi engaphansi yangasese, kuthumela ukuhamba ngokuphuma okungakaze kukalwe kukho.
Qinisekisa ukuphuma bese ubheka eminye imindeni yamakheli
Cela ikheli lomphakathi kusisebenzi esibika umthombo, bese uliqhathanisa nekheli le-WAN lenodi yokuphuma. Bese ulayisha isayithi ngegama ukuze uqinisekise ukuthi i-DNS isaxazulula, futhi uhlole uhlelo lokusebenza olulodwa olubalulekile hhayi isiphequluli kuphela.
Iklayenti enezingqimba ezimbili ingaqhubeka nokusebenzisa umzila wayo wemvelo we-IPv6 ngenkathi i-IPv4 iphuma nge-ZeroTier. Uma inhloso iwukufihla noma ukuphatha konke ukuhamba, kudingeka umzila ohlukile we-::/0 nokudlulisa kwe-IPv6 kokuphuma, futhi ukuhlolwa kwe-IPv4 akusho lutho ngakho.
Ukuhlunga komzila ohlanekezelayo kwe-Linux nakho kungalahla ukuhamba kokuphuma okuvumelekile kuklayenti. I-ZeroTier ibhala ukucatshangelwa kwe-rp_filter kumalungu abamba iqhaza; shintsha lokho kulungiselelwa ngamabomu futhi kuphela ngemuva kokuqinisekiswa komzila ne-NAT, hhayi njengokuhlola kokuqala.
Uma imfuneko iwukufinyelela kwi-NAS noma isethi eyodwa yasehhovisi, umzila ophethwe waleyo ngxenye unoshintsho oluncane noluphephile kunokuphuma okuphelele. Ukuthumela konke ukuphequlula ngesinye isisetshenziswa kuyisinqumo esihlukile ekufinyeleleni insiza eyodwa yangasese, futhi kufanele kubuyekezwe ngokwahlukile.