ืืืึธืก ืืขื ืขื ืืืจ ืืึธืื ืฆื ืื ืืึธื ืคืื IPv6?
ืึทื ืก ืจืขืื, ืืืจ ืืืขืื ืืึธืื ืื ืืขืืืข ืฆื ืื ืืึธื ืคืื ืขื ืงืจืืคึผืฉืึทื ืืืึทื ื.
ืืึธ ืืืจ ืืืขืื ืจืขืื ืืืขืื ืึทื ืึทื ืขื ืงืจืืคึผืืื IPv4 ืืื ืขื, ืึธืืขืจ ื ืืฉื ืืืขืื ืึท "ืืืึทืจืขื ืืึธืืคึผ", ืึธืืขืจ ืืืขืื ืึท ืืึธืืขืจื "ืืขืคืืจื". ืืื ืขืก ืืขื ืขื ืืืื ืจืื ืกืึทืงืึทืฅ ืคืืึทืฉืื ื ืืึธ, ืืื ืึทืจืืขื ืืื ืึทื ืืขืจืืืื ืืื ืคึผืึทืงืืฅ ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืขืก ืืขื ืขื ืขื ืืึทื ืึทืืื ื ืคึผืจืึธืืึธืงืึธืืก ืคึฟืึทืจ ืืขืืขืจ ืืขื ืืื ืงืึธืืืจ:
- ืืึธืืขืจื, ืืึธืืขืจื, ืืืื ื
- ืืืืืืคืื ืงืืืึธื ืึทื, ืืื ืฉืืืืืฆืขืจ ื ืืืืื, OpenVPN ืืื SSH
- ืึทืื ืืื ื ืื ืืืื GRE
- ืื ืืขืจืกื ืคึผืฉืื, ืฉื ืขื, ืืึธืจ ืึทื ืขื ืงืจืืคึผืืื IPIP
- ืึทืงืืืืืื ืืขืืืขืืึธืคึผืื ื
- ืคืืืข ืื ืืขืจืข.
ืืืขืจ ืืื ืืื ืึท ืคึผืจืึธืืจืึทืืืกื, ืึทืืื ืืื ืืืขื ืคืึทืจืืจืขืกืขืจื N ืืืืื ืืื ืึท ืืจืึธืืฆืึธื, ืืื ืืึธืื ืื ืึทื ืืืืืงืืื ื ืคืื ืคืึทืงืืืฉ ืคึผืจืึธืืึธืงืึธืืก ืฆื ืงืึธืืืขืจืกืึทื ื ืืขืืืขืืึธืคึผืขืจืก.
ืืื ืืืื ืขื ื ืื ื ืืฉื ืืขืืืืจื ืืืึธืก ืืื ืืึธื ืืืฆื ืืื ืฆื ืืขืจืืจืืืื ืืึธืกืฅ ืืื ืืขืจ NAT ืคึฟืื ืื ืึทืจืืืก. ื ืืฆื ืคึผืจืึธืืึธืงืึธืืก ืืื ืืขืจืืืึทืงืกื ืงืจืืคึผืืึธืืจืึทืคื ืคึฟืึทืจ ืืขื, ืืื ืงืขื ื ืืฉื ืืจืืืกืืขื ืื ืืขืคืื ืึทื ืขืก ืืื ืืื ืฆื ืืจืืืขื ืคืืืืึทืื ืคืื ืึท ืงืึทื ืึธื. ืืืืึทื ืืขืจ ืืื ืขื ืืื ืืขืจืกืื ืก ืืขื ืืฆื ืืืืื ืฆื ืฉืืืจืืขื ืืึธืืขืก ืืื NAT-e, ืื ืขืจืืขื ืคืึทืจืงืขืจ ืืื ืืืืฉืึทืืืึทืื ืืืื ืื ืงืจืืคึผืืื, ืึธืืขืจ ืืื ื ืึธื ืืขืจืืจืื ืงืขื ืืื ืืืืคึผืก.
ืืฉืขืช ืจืืกืขืจืืฉืื ื ืคืึทืจืฉืืื ืืึทื ืึทืืื ื ืคึผืจืึธืืึธืงืึธืืก, ืืืื ืื ืขืจ ืคึผืขืจืคืขืงืฉืึทื ืืกื ืก ืืคืืขืจืงืืึทืืงืืื ืืื ืืขืฆืืืื ืฆื IPIP ืืืืขืจ ืืื ืืืืขืจ ืืืืืขืจ ืจืขืื ืฆื ืืืื ืืื ืืืึทื ืึธืืืืขืจืืขื. ืึธืืขืจ ืขืก ืืื ืืืื ืืื ืึท ืืึทืื ืืึทืืืึทืืืง ืืืกืึทืืืืึทื ืืืืืฉืื ืคึฟืึทืจ ืืืื ืืึทืกืงืก:
- ืขืก ืจืืงืืืืืขืจื ืขืคื ืืืขื IPs ืืืืฃ ืืืืืข ืืืืื,
- ืืื ืงืืื ืึธืืขื ืืึทืงืืืฉืึทื ืคึฟืึทืจ ืืืจ.
ืืขืจืืืข ืจ ืื ื ืืข ื ืืข ื ืคืขืจืคืขืงืฆืืื ืืกื ื ืฆืืจื ืง ืืขืืจืื ื ืื ื ืืข ืจ ืคืื ืฆืืขืจืข ืจ ืฐืื ืง ื ืคื ื ืฉืืจืื , ืืืข ืจ ืฐื ื ืข ืจ ืืืฆ ื ืืืจื .
ืืื ืืขืืึธืื ืืืื ืืึธื, ืืฉืขืช ืืืืขื ืขื ืึทืจืืืงืืขื ืืืืฃ ืืื ืืื ืืงืก ืืื ืืขืงืืืขื ืึทืจืืืขืจ FOU (Foo-over-UDP), ื.ื. ืืืขืืืขืจ, ืืื ืืขืืืืงืื ืืื UDP. ืืื ืืืฆื, ืืืืื IPIP ืืื GUE (ืืขื ืขืจืืง UDP ืขื ืงืึทืคึผืกืืืึทืืืึธื) ืืขื ืขื ืืขืฉืืืฆื.
โ ืึธื ืืื ืืขืจ ืืืืืขืจื ืขืจ ืงืืื! ื ืคึผืฉืื IPIP ืืื ืืขื ืื ืคึฟืึทืจ ืืืจ. โ - ืืื ืืื ืืขืืจืืื.
ืืื ืคืึทืงื, ืื ืงืืื ืืื ืืขืืืขื ื ืื ืืึธืจ ืืืืืขืจ. ืขื ืงืึทืคึผืกืืืึทืืืึธื ืืื UDP ืกืึทืืืื ืืขืจ ืขืจืฉืืขืจ ืคึผืจืึธืืืขื - ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืฆื ืงืืืืึทื ืฅ ืืื ืืขืจ NAT ืคึฟืื ืื ืึทืจืืืก ื ืืฆื ืึท ืคืึทืจ-ืืขืืจืื ืืขื ืคึฟืึทืจืืื ืืื ื, ืึธืืขืจ ืืึธ ืืขืืคื ืคืื ืื ืืืืึทืืขืจ ืฉืืขืจืื ื ืคืื IPIP ืืืึทืกืึทืื ืืื ืึท ื ืืึทืข ืืืื - ืืืขืจ ืขืก ืื ืคึฟืื ืึท ืคึผืจืืืืึทื ื ืขืฅ ืงืขื ืขื ืืึทืืึทืืื ืืื ืืขืจ ืื ืงืขื ืืืง. ืฆืืืืจ IP ืืื ืงืืืขื ื ืคึผืึธืจื (ืืื ืจืืื IPIP ืืขื ืคึผืจืึธืืืขื ืืื ื ืืฉื ืขืงืกืืกืืืจื).
ืฆื ืกืึธืืืืข ืืขื ืืืื ืืื ืึท ืืึทืื ืคึผืจืึธืืืขื, ืื ื ืืฆื ืืื ืืขืืืืจื . ืขืก ืืืคึผืืึทืืึทื ืฅ ืึท ืืืื-ืืขืืืื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืึธืืขื ืืึทืงืืืืื ื ืึท ืืืืึทื ืืึทืืขืืึธืก, ืึธื ืืืกืจืึทืคึผืืื ื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืงืขืจื FOU, ืืืึธืก ืืืขื ืืขืฉืืืื ื ืืื ืืคืืฉืึทื ืืื ืคึผืจืึธืฆืขืก ืคึผืึทืงืืฅ ืืื ืงืขืจื ืคึผืืึทืฅ.
ืืืจ ืืึทืจืคึฟื ื ืื ืืืื ืฉืจืืคื!
ืืื, ืืืื ืืืจ ืืืืกื ืื ืขืคื ืืืขื ืคึผืึธืจื ืืื IP ืคืื ืืขื ืงืืืขื ื (ืืืฉื, ืึทืืขืืขื ืืื ืืขืจ ืขืก ืืืื ื ืืฉื ืขืจืืขืฅ, NAT ืคืจืืืื ืฆื ืืึทืคึผืข ืคึผืึธืจืฅ 1-ืืื-1), ืืืจ ืงืขื ืขื ืืึทืื ืึทื IPIP-ืืืืขืจ-FOU ืืื ืขื ืืื ืื ืืืืึทืืขืจืืืง ืงืึทืืึทื ืื, ืึธื ืงืืื ืกืงืจืืคึผืก.
ืืืืฃ ืกืขืจืืืขืจ:
# ะะพะดะณััะทะธัั ะผะพะดัะปั ัะดัะฐ FOU
modprobe fou
# ะกะพะทะดะฐัั IPIP ััะฝะฝะตะปั ั ะธะฝะบะฐะฟััะปััะธะตะน ะฒ FOU.
# ะะพะดัะปั ipip ะฟะพะดะณััะทะธััั ะฐะฒัะพะผะฐัะธัะตัะบะธ.
ip link add name ipipou0 type ipip
remote 198.51.100.2 local 203.0.113.1
encap fou encap-sport 10000 encap-dport 20001
mode ipip dev eth0
# ะะพะฑะฐะฒะธัั ะฟะพัั ะฝะฐ ะบะพัะพัะพะผ ะฑัะดะตั ัะปััะฐัั FOU ะดะปั ััะพะณะพ ััะฝะฝะตะปั
ip fou add port 10000 ipproto 4 local 203.0.113.1 dev eth0
# ะะฐะทะฝะฐัะธัั IP ะฐะดัะตั ััะฝะฝะตะปั
ip address add 172.28.0.0 peer 172.28.0.1 dev ipipou0
# ะะพะดะฝััั ััะฝะฝะตะปั
ip link set ipipou0 up
ืืืืฃ ืืขื ืงืืืขื ื:
modprobe fou
ip link add name ipipou1 type ipip
remote 203.0.113.1 local 192.168.0.2
encap fou encap-sport 10001 encap-dport 10000 encap-csum
mode ipip dev eth0
# ะะฟัะธะธ local, peer, peer_port, dev ะผะพะณัั ะฝะต ะฟะพะดะดะตัะถะธะฒะฐัััั ััะฐััะผะธ ัะดัะฐะผะธ, ะผะพะถะฝะพ ะธั
ะพะฟัััะธัั.
# peer ะธ peer_port ะธัะฟะพะปัะทััััั ะดะปั ัะพะทะดะฐะฝะธั ัะพะตะดะธะฝะตะฝะธั ััะฐะทั ะฟัะธ ัะพะทะดะฐะฝะธะธ FOU-listener-ะฐ.
ip fou add port 10001 ipproto 4 local 192.168.0.2 peer 203.0.113.1 peer_port 10000 dev eth0
ip address add 172.28.0.1 peer 172.28.0.0 dev ipipou1
ip link set ipipou1 up
ืืื
ipipou*- ื ืึธืืขื ืคืื ืื ืืืืข ืืื ืขื ื ืขืฅ ืฆืืืื ื203.0.113.1- ืฆืืืืจ IP ืกืขืจืืืขืจ198.51.100.2- ืฆืืืืจ IP ืคืื ืืขื ืงืืืขื ื192.168.0.2- ืงืืืขื ื IP ืึทืกืืื ื ืฆื ืฆืืืื ื eth010001- ืืืงืืืข ืงืืืขื ื ืคึผืึธืจื ืคึฟืึทืจ FOU20001- ืฆืืืืจ ืงืืืขื ื ืคึผืึธืจื ืคึฟืึทืจ FOU10000- ืฆืืืืจ ืกืขืจืืืขืจ ืคึผืึธืจื ืคึฟืึทืจ FOUencap-csum- ืึธืคึผืฆืืข ืฆื ืืืืื ืึท UDP ืืฉืขืงืงืกืื ืฆื ืขื ืงืึทืคึผืกืึทืืืืืื UDP ืคึผืึทืงืืฅ; ืงืขื ืขื ืืืื ืจืืคึผืืืืกื ืืืจืnoencap-csum, ื ืื ืฆื ืืขืจืืึธื ืขื, ืึธืจื ืืืขืืงืืึทื ืืื ืฉืืื ืงืึทื ืืจืึธืืื ืืืจื ืื ืืืกืืืืื ืืงืกื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืฉืืืืข (ืืฉืขืช ืื ืคึผืึทืงืึทื ืืื ืื ืื ืืื ืขื)eth0- ืืืืข ืฆืืืื ื ืฆื ืืืึธืก ืื ืืคึผืืคึผ ืืื ืขื ืืืขื ืืืื ืืขืืื ืื172.28.0.1- IP ืคืื ืื ืงืืืขื ื ืืื ืขื ืฆืืืื ื (ืคึผืจืืืืึทื)172.28.0.0- IP ืืื ืขื ืกืขืจืืืขืจ ืฆืืืื ื (ืคึผืจืืืืึทื)
ืืื ืืึทื ื ืืื ืื UDP ืคึฟืึทืจืืื ืืื ื ืืื ืืขืืขืืืง, ืืขืจ ืืื ืขื ืืืขื ืืืื ืืื ืืจืืขืื ืกืืจ, ืึธืืขืจ ืืืื ืขืก ืืจืืืงืก, ืืืจ ืืืขื ืืืื ืืึทืืืืืง - ืืืื ืืขืจ ืงืืืขื ื ืก IP: ืคึผืึธืจื ืืืืืื ืื ืืขืืืข - ืขืก ืืืขื ืืขืื, ืืืื ืืื ืืืืฉื - ืขืก ืืืขื ืืจืขืื.
ืื ืืืืึทืกื ืืืขื ืฆื ืงืขืจ ืึทืืฅ ืฆืืจืืง ืืื ืฆื ืึทื ืืึธืื ืื ืงืขืจื ืืึทืืืฉืืื: modprobe -r fou ipip
ืืคืืื ืืืื ืึธืืขื ืืึทืงืืืฉืึทื ืืื ื ืืฉื ืคืืจืืื ืื, ืืขืจ ืฆืืืืจ IP ืืื ืคึผืึธืจื ืคืื ืืขื ืงืืืขื ื ืืขื ืขื ื ืืฉื ืฉืืขื ืืืง ืืึทืืืืกื ืืื ืืขื ืขื ืึธืคื ืึทื ืคึผืจืืืืงืืึทืืึทื ืึธืืขืจ ืืืึทืืขืืืืืง (ืืืคึผืขื ืืื ื ืืืืฃ ืื NAT โโืืืคึผ). ืืืื ืืืจ ืคืึทืจืืึธืื encap-dport ืืืืฃ ืื ืกืขืจืืืขืจ ืืืึทื, ืืขืจ ืืื ืขื ืืืขื ื ืืฉื ืึทืจืืขืื, ืขืก ืืื ื ืืฉื ืงืืื ืืขื ืื ืฆื ื ืขืืขื ืื ืืืืึทื ืงืฉืจ ืคึผืึธืจื. ืืื ืืขื ืคืึทื, ipipou ืงืขื ืขื ืืืื ืืขืืคึฟื, ืึธืืขืจ WireGuard ืืื ืื ืืขืจืข ืืื ืขืก ืงืขื ืขื ืืขืืคึฟื ืืืจ.
ืืื ืืื ืขืก ืึทืจืืขื?
ืืขืจ ืงืืืขื ื (ืืืึธืก ืืื ืืืืฉืึทืืืึทืื ืืื ืืขืจ NAT) ืขืคึฟื ื ืึท ืืื ืขื (ืืื ืืื ืืขื ืืืึทืฉืคึผืื ืืืืื), ืืื ืกืขื ืื ืึท ืึธืืขื ืืึทืงืืืฉืึทื ืคึผืึทืงืึทื ืฆื ืื ืกืขืจืืืขืจ ืึทืืื ืึทื ืขืก ืงืึทื ืคืืืืขืจ ืื ืืื ืขื ืืืืฃ ืืืื ืืืึทื. ืืขืคึผืขื ืืื ื ืืืืฃ ืื ืกืขืืืื ืืก, ืืึธืก ืงืขื ืืืื ืึท ืืืืืืง ืคึผืึทืงืึทื (ื ืึธืจ ืึทืืื ืึทื ืืขืจ ืกืขืจืืืขืจ ืงืขื ืขื ืืขื ืื ืขืคื ืืืขื IP: ืคึฟืึทืจืืื ืืื ื ืคึผืึธืจื), ืึธืืขืจ ืืื ืืึทืื ืืืจื ืืืึธืก ืืขืจ ืกืขืจืืืขืจ ืงืขื ืขื ืืืขื ืืืคืืฆืืจื ืืขื ืงืืืขื ื. ืื ืืึทืื ืงืขื ืขื ืืืื ืึท ืคึผืฉืื ืคึผืึทืกืคืจืึทืกืข ืืื ืงืืึธืจ ืืขืงืกื (ืื ืึทื ืึทืืึทืืืฉื ืืื HTTP Basic Auth ืงืืื ืฆื ืืืื ืื ื) ืึธืืขืจ ืกืคึผืขืฉืื ืืืืืื ื ืืึทืื ืืขืืชืืขื ืืื ืึท ืคึผืจืืืืึทื ืฉืืืกื (ืขื ืืขื ืฆื HTTP Digest Auth ืืืืื ืฉืืืจืงืขืจ, ืืขื ืคืื ืงืฆืืข client_auth ืืื ืื ืงืึธื).
ืืืืฃ ืื ืกืขืจืืืขืจ (ืื ืืืึทื ืืื ืื ืขืคื ืืืขื IP), ืืืขื ipipou ืกืืึทืจืฅ, ืขืก ืงืจืืืืฅ ืึท nfqueue ืจืื ืืึทื ืืืขืจ ืืื ืงืึทื ืคืืืืขืจ ื ืขืืคืืืืขืจ ืึทืืื ืึทื ืื ื ืืืืืง ืคึผืึทืงืืฅ ืืขื ืขื ืืขืฉืืงื ืืื ืืื ืืึธื ืืืื: ืคึผืึทืงืืฅ ืื ืืืืึทืืืืื ื ืื ืงืฉืจ ืฆื ืื nfqueue ืจืื, ืืื [ืึผืืขื] ืึทืืข ืื ืื ืืื ืืืื ืืืืื ืฆื ืื ืฆืืืขืจืขืจ FOU.
ืคึฟืึทืจ ืืขื ืข ืืืึธืก ืืึธื ื ืื ืืืืกื, nfqueue (ืึธืืขืจ NetfilterQueue) ืืื ืึท ืกืคึผืขืฆืืขื ืืึทื ืคึฟืึทืจ ืึทืืึทืืฉืขืจื ืืืึธืก ืืึธื ื ืื ืืืืกื ืืื ืฆื ืึทื ืืืืืงืืขื ืงืขืจื ืืึทืืืฉืืื, ืืืึธืก ื ืืฆื ื ืขืืคืืืืขืจ (nftables / iptables) ืึทืืึทืื ืืืจ ืฆื ืจืืืขืจืขืงื ื ืขืฅ ืคึผืึทืงืืฅ ืฆื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืื ืคึผืจืึทืกืขืกืื ื ืืื ืืึธืจื. ืคึผืจืืืืืืื ืืืื ืืื ืืึทื ื: ืืึธืืืคืืฆืืจื (ืึทืคึผืฉืึทื ืึทื) ืืื ืืขืื ืขืก ืฆืืจืืง ืฆื ืื ืงืขืจื, ืึธืืขืจ ืึทืืืขืงืืืึทืจืคื ืขืก.
ืคึฟืึทืจ ืขืืืขืืข ืคึผืจืึธืืจืึทืืืื ื ืฉืคืจืึทืื ืขืก ืืขื ืขื ืืืื ืืื ืื ืคึฟืึทืจ ืืจืืขืื ืืื nfqueue, ืคึฟืึทืจ bash ืขืก ืืื ืืขืืืขื ืืึธืจื ืื (ืืข, ื ืื ืืืืืฉ), ืืื ืืื ืฆื ื ืืฆื ืคึผืืืืึธื: ipipou ื ืืฆื .
ืืืื ืื ืคืึธืจืฉืืขืืื ื ืืื ื ืืฉื ืงืจืืืืฉ, ืืื ืืขื ืืึทื ืืืจ ืงืขื ืขื ืืขืคืืขืจืขื ืืขืฉืืืื ื ืืื ืืืืื ืฆืื ืืืคืืืกื ืืืื ืืืืืขื ืข ืืึธืืืง ืคึฟืึทืจ ืืจืืขืื ืืื ืคึผืึทืงืืฅ ืืืืฃ ืึท ืืึทื ืฅ ื ืืืขืจืืง ืืืจืื, ืืืฉื, ืฉืึทืคึฟื ืืงืกืคึผืขืจืืขื ืึทื ืืึทืื ืึทืจืืืขืจืคืืจื ืคึผืจืึธืืึธืงืึธืืก ืึธืืขืจ ืืจืึธืื ืืืืข ืืื ืืืืึทื ืืึทืืื ืื ืืก ืืื ื ืื-ื ืึธืจืืึทื ื ืึทืืืจ.
ืจืื ืกืึทืงืึทืฅ ืึทืจืืขื ืืึทื ื ืืื ืืึทื ื ืืื nfqueue, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืขื ืืขืจ ืืื ืขื ืืื ืฉืืื ืงืึทื ืคืืืืขืจื ืืื FOU ืืื ืฆืืืขืืขืจื ืืืืฃ ืื ืืขืืขืื ืคึผืึธืจื, ืืืจ ืืืขื ื ืืฉื ืงืขื ืขื ืฆื ืฉืืงื ืึท ืคึผืึทืงืึทื ืคืื ืื ืืขืืืข ืคึผืึธืจื ืืืืฃ ืื ืืขืืืืื ืืืขื ืืืขื - ืขืก ืืื ืคืึทืจื ืืืขื, ืึธืืขืจ ืืืจ ืงืขื ืขื ื ืขืืขื ืืื ืฉืืงื ืึท ืจืึทื ืืึทืืื ืืืฉืขื ืขืจืืืืึทื ืคึผืึทืงืึทื ืืืืึทื ืฆื ืื ื ืขืฅ ืฆืืืื ื ื ืืฆื ืึท ืจืื ืืึธืืขื, ืืึธืืฉ ืืืฉืขื ืขืจืืืืื ื ืึทืืึท ืึท ืคึผืึทืงืึทื ืืืขื ืืึทืจืคื ืึท ืืืกื ืืขืจ ืืื ืงืขืจืื ื. ืืึธืก ืืื ืืื ืคึผืึทืงืืฅ ืืื ืึธืืขื ืืึทืงืืืฉืึทื ืืขื ืขื ืืืฉืืคื ืืื ipipou.
ืืื ื ipipou ืคึผืจืึทืกืขืกืึทื ืืืืื ืื ืขืจืฉืืขืจ ืคึผืึทืงืืฅ ืคืื ืื ืงืฉืจ (ืืื ืื ืืืึธืก ืืึธืื ืืขืจืืื ืฆื ืจืื ืขื ืืื ืื ืจืื ืืืืืขืจ ืื ืงืฉืจ ืืื ืืขืืจืื ืืขื), ืื ืคืึธืจืฉืืขืืื ื ืึผืืขื ื ืืฉื ืืืืื.
ืืื ืืึทืื ืืื ืืขืจ ipipou ืกืขืจืืืขืจ ืืืงืืื ืึท ืึธืืขื ืืึทืงืืืืึทื ืคึผืึทืงืึทื, ืึท ืืื ืขื ืืื ืืืฉืืคื ืืื ืึทืืข ืกืึทืืกืึทืงืืืึทื ื ืคึผืึทืงืืฅ ืืื ืื ืงืฉืจ ืืขื ืขื ืฉืืื ืคึผืจืึทืกืขืกื ืืืจื ืื ืงืขืจื ืืืืคึผืึทืกืื ื nfqueue. ืืืื ืื ืงืฉืจ ืคืืืื, ืืขืจ ืขืจืฉืืขืจ ืคึผืึทืงืึทื ืคืื ืืขืจ ืืืืึทืืขืจ ืืืื ืขืจ ืืืขื ืืืื ืืขืฉืืงื ืฆื ืื nfqueue ืจืื, ืืืคึผืขื ืืื ื ืืืืฃ ืื ืกืขืืืื ืืก, ืืืื ืขืก ืืื ื ืืฉื ืึท ืคึผืึทืงืึทื ืืื ืึธืืขื ืืึทืงืืืฉืึทื, ืึธืืขืจ ืคึฟืื ืื ืืขืฆืืข ืืขืจืืื ื IP ืืื ืงืืืขื ื ืคึผืึธืจื, ืขืก ืงืขื ืืืื ืืืจืืืขืืื ืืขื. ืืืืฃ ืึธืืขืจ ืึทืืืขืงืืขื ืืืขื. ืืืื ืึท ืึธืืขื ืืึทืงืืืืึทื ืคึผืึทืงืึทื ืงืืื ืคึฟืื ืึท ื ืืึทืข IP ืืื ืคึผืึธืจื, ืืขืจ ืืื ืขื ืืื ืจืืงืึทื ืคืืืืขืจื ืฆื ื ืืฆื ืืื.
ืื ืืขืืืืื ืืืขื IPIP-ืืืืขืจ-FOU ืืื ื ืึธื ืึท ืคึผืจืึธืืืขื ืืืขื ืืจืืขืื ืืื NAT - ืขืก ืืื ืืืืืขืืืขื ืฆื ืฉืึทืคึฟื ืฆืืืื IPIP ืืึทื ืึทืื ืขื ืงืึทืคึผืกืึทืืืืืื ืืื UDP ืืื ืืขืจ ืืขืืืืงืขืจ IP, ืืืืึทื ืื FOU ืืื IPIP ืืึทืืืฉืืื ืืขื ืขื ืืึทื ืฅ ืืคืืขืืื ืืขืจื ืคืื ืืขืืขืจ ืื ืืขืจืขืจ. ืืขื ืข. ืึท ืคึผืึธืจ ืคืื ืงืืืืึทื ืฅ ืืื ืืขืจ ืืขืจ ืืขืืืืงืขืจ ืขืคื ืืืขื IP ืืืขื ื ืืฉื ืงืขื ืขื ืฆื ืกืืืืึทืืืืื ืืึทืกืื ืคืึทืจืืื ืื ืฆื ืืขืจ ืืขืืืืงืขืจ ืกืขืจืืืขืจ ืืืืฃ ืืขื ืืืขื. ืืื ืฆืืงืื ืคื, , ืขืก ืืืขื ืืืื ืกืึทืืืื ืืื ืื ืงืขืจื ืืืจืื, ืึธืืขืจ ืืึธืก ืืื ื ืืฉื ืืืืขืจ. ืืื ืืขืจ ืืขืจืืืืื, NAT ืคึผืจืึธืืืขืืก ืงืขื ืขื ืืืื ืกืึทืืืื ืืืจื NAT - ืืืื ืขืก ืืึทืคึผืึทื ื ืึทื ืึท ืคึผืึธืจ ืคืื IP ืึทืืจืขืกืขืก ืืื ืฉืืื ืคืึทืจื ืืืขื ืืืจื ืื ืื ืืขืจ ืืื ืขื, ipipou ืืืขื ืืึธื NAT ืคืื ืฆืืืืจ ืฆื ืึทื ืื ืืขืจ ืืจืืจื ืคึผืจืืืืึทื IP, ืืืืืึทืืึท! - ืืืจ ืงืขื ืขื ืืึทืื ืืึทื ืึทืื ืืื ืื ืคึผืึธืจืฅ ืืืืคื ืืืืก.
ืืืืึทื ื ืื ืึทืืข ืคึผืึทืงืืฅ ืืื ืื ืคึฟืึทืจืืื ืืื ื ืืขื ืขื ืืขืืชืืขื, ืืขืจ ืคึผืฉืื ืฉืืฅ ืืื ืฉืคึผืืจืขืืืืืง ืฆื MITM, ืึทืืื ืืืื ืขืก ืืื ืึท ืจืึธืฉืข ืืขืจืงืื ื ืืืืฃ ืืขื ืืจื ืฆืืืืฉื ืืขื ืงืืืขื ื ืืื ืื ืกืขืจืืืขืจ ืืืึธืก ืงืขื ืขื ืืขืจื ืฆื ืื ืคืึทืจืงืขืจ ืืื ืืึทื ืืคึผืืืืจื ืขืก, ืขืจ ืงืขื ืขื ืจืืืขืจืขืงื ืึธืืขื ืืึทืงืืืืึทื ืคึผืึทืงืืฅ ืืืจื ืื ืื ืืขืจ ืึทืืจืขืก ืืื ืฉืึทืคึฟื ืึท ืืื ืขื ืคืื ืึท ืึทื ืืจืึทืกืืื ืืึทืืขืืึธืก.
ืืืื ืืืขืจ ืขืก ืื ืืื ืืืืืึทื ืืื ืฆื ืคืึทืจืจืืืื ืืขื ืืฉืขืช ืืึธืื ืื ืคืึทืจื ืขื ืคืื ืื ืคืึทืจืงืขืจ ืืื ืื ืืึทืจืฅ, ืืึธื ื ืื ืงืืืขื ืงืืขื ืฆื ืจืขืื.
ืืืจื ืืขื ืืืขื, ืขื ืงืึทืคึผืกืืืึทืืืึธื ืืื UDP ืืื ืคึผืจืึธืืืขื ืืื ืืืืขืจ ืืื. ืงืึทืืคึผืขืจื ืืื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืืืืขืจ IP, ืขืก ืืื ืคืื ืืขืจ ืกืืึทืืื ืืื ืึธืคื ืคืึทืกืืขืจ ืืจืึธืฅ ืื ื ืึธื ืึธืืืืขืจืืขื ืคืื ืื UDP ืืขืืขืจ. ืืึธืก ืืื ืจืขืื ืฆื ืืขื ืคืึทืงื ืึทื ืจืืึฟ ืืื ืืช ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ ืึทืจืืขื ืืขืืื ื ืืืืื ืืื ืื ืืจืื ืืขืจืกื ืคืึธืืงืก ืคึผืจืึธืืึธืงืึธืืก: TCP, UDP, ICMP. ืืขืจ ืืึทืืึธืฉืขืกืืืง ืืืื ืงืขื ืขื ืืึธืจ ืึทืืืขืงืืืึทืจืคื ืึทืืฅ ืึทื ืืขืจืฉ, ืึธืืขืจ ืคึผืจืึธืฆืขืก ืขืก ืืขืจ ืกืืึธืืื, ืืืืึทื ืขืก ืืื ืึธืคึผืืืืืืขื ืืืืื ืคึฟืึทืจ ืื ืืจืื.
ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืึธืก ืืื ืืืึธืก QUICK, ืืืืฃ ืืืึธืก ืืืืคึผ / 3 ืืื ืืืืืจื, ืืื ืืืฉืืคื ืืืืฃ ืฉืคึผืืฅ ืคืื UDP, ืืื ื ืืฉื ืืืืฃ ืฉืคึผืืฅ ืคืื IP.
ื ื, ืืขื ืื ืืืขืจืืขืจ, ืขืก ืืื ืฆืืื ืฆื ืืขื ืืื ืขืก ืึทืจืืขื ืืื ืืขืจ "ืคืึทืงืืืฉ ืืืขืื".
ืฉืืึทืื
ืืขืืืืื ื ืฆื ืขืืืึทืืืื ืื ืคืึทืงืืืฉ ืืืขืื iperf3. ืืื ืืขืจืืื ืขื ืคืื ืื ืืจืึทื ืคืื ื ืึธืขื ืืงืืื ืฆื ืคืึทืงื, ืืึธืก ืืื ืืขืขืจืขื ืืขืจ ืืขืืืืงืขืจ ืืื ืขืืืึทืืืืืื ื ืื ืคืึทืงืืืฉ ืืืขืื ืืื ืืื ืขืงืจืึทืคื, ืึธืืขืจ ืืืฆื ืขืก ืืืขื ืืึธื.
ืคึผืึทืจืืืกืึทืคึผืึทื ืฅ ืืื ืื ืคืึทืจืืขืกื:
- ืืขืจืืึธื ืขื ืืืืคึผื ืงืึทื ืึทื
- ืืขืจ ืืขืื ืคืื ืืขื ืึทืจืืืงื ืืื ipipou
- OpenVPN ืืื ืึธืืขื ืืึทืงืืืฉืึทื ืึธืืขืจ ืงืืื ืขื ืงืจืืคึผืฉืึทื
- OpenVPN ืืื ืึทืืข-ืื ืงืืืกืืื ืืึธืืข
- WireGuard ืึธื PresharedKey, ืืื MTU = 1440 (ืืื ื IPv4-ืืืืื)
ืืขืื ืืฉ ืืึทืื ืคึฟืึทืจ ืืขืงืก
ืืขืืจืืงืก ืืขื ืขื ืืขื ืืืขื ืืื ืื ืคืืืืขื ืืข ืงืึทืืึทื ืื:
ืืืืฃ ืืขื ืงืืืขื ื:
ืืืคึผ
CPULOG=NAME.udp.cpu.log; sar 10 6 >"$CPULOG" & iperf3 -c SERVER_IP -4 -t 60 -f m -i 10 -B LOCAL_IP -P 2 -u -b 12M; tail -1 "$CPULOG"
# ะะดะต "-b 12M" ััะพ ะฟัะพะฟััะบะฝะฐั ัะฟะพัะพะฑะฝะพััั ะพัะฝะพะฒะฝะพะณะพ ะบะฐะฝะฐะปะฐ, ะดะตะปัะฝะฝะฐั ะฝะฐ ัะธัะปะพ ะฟะพัะพะบะพะฒ "-P", ััะพะฑั ะปะธัะฝะธะต ะฟะฐะบะตัั ะฝะต ะฟะปะพะดะธัั ะธ ะฝะต ะฟะพััะธัั ะฟัะพะธะทะฒะพะดะธัะตะปัะฝะพััั.
ืืงืคึผ
CPULOG=NAME.tcp.cpu.log; sar 10 6 >"$CPULOG" & iperf3 -c SERVER_IP -4 -t 60 -f m -i 10 -B LOCAL_IP -P 2; tail -1 "$CPULOG"
ICMP ืืืืืึทื ืกื
ping -c 10 SERVER_IP | tail -1
ืืืืฃ ืื ืกืขืจืืืขืจ (ืืืืคื ืกืืืืึทืืืืื ืืึทืกืื ืืื ืืขื ืงืืืขื ื):
ืืืคึผ
CPULOG=NAME.udp.cpu.log; sar 10 6 >"$CPULOG" & iperf3 -s -i 10 -f m -1; tail -1 "$CPULOG"
ืืงืคึผ
CPULOG=NAME.tcp.cpu.log; sar 10 6 >"$CPULOG" & iperf3 -s -i 10 -f m -1; tail -1 "$CPULOG"
ืืื ืขื ืงืึทื ืคืืืืขืจืืืฉืึทื
ipipou
ืกืขืจืืืขืจ
/etc/ipipou/server.conf:
server
number 0
fou-dev eth0
fou-local-port 10000
tunl-ip 172.28.0.0
auth-remote-pubkey-b64 eQYNhD/Xwl6Zaq+z3QXDzNI77x8CEKqY1n5kt9bKeEI=
auth-secret topsecret
auth-lifetime 3600
reply-on-auth-ok
verb 3
systemctl start ipipou@server
ืงืืืขื ื
/etc/ipipou/client.conf:
client
number 0
fou-local @eth0
fou-remote SERVER_IP:10000
tunl-ip 172.28.0.1
# pubkey of auth-key-b64: eQYNhD/Xwl6Zaq+z3QXDzNI77x8CEKqY1n5kt9bKeEI=
auth-key-b64 RuBZkT23na2Q4QH1xfmZCfRgSgPt5s362UPAFbecTso=
auth-secret topsecret
keepalive 27
verb 3
systemctl start ipipou@client
openvpn (ืงืืื ืขื ืงืจืืคึผืฉืึทื, ืืื ืึธืืขื ืืึทืงืืืฉืึทื)
ืกืขืจืืืขืจ
openvpn --genkey --secret ovpn.key # ะะฐัะตะผ ะฝะฐะดะพ ะฟะตัะตะดะฐัั ovpn.key ะบะปะธะตะฝัั
openvpn --dev tun1 --local SERVER_IP --port 2000 --ifconfig 172.16.17.1 172.16.17.2 --cipher none --auth SHA1 --ncp-disable --secret ovpn.key
ืงืืืขื ื
openvpn --dev tun1 --local LOCAL_IP --remote SERVER_IP --port 2000 --ifconfig 172.16.17.2 172.16.17.1 --cipher none --auth SHA1 --ncp-disable --secret ovpn.key
openvpn (ืืื ืขื ืงืจืืคึผืฉืึทื, ืึธืืขื ืืึทืงืืืฉืึทื, ืืืจื UDP, ืึทืืฅ ืืื ืืขืจืืืึทืจื)
ืงืึทื ืคืืืืขืจื ื ืืฆื
ืืืืจืขืืืึทืจื
ืกืขืจืืืขืจ
/etc/wireguard/server.conf:
[Interface]
Address=172.31.192.1/18
ListenPort=51820
PrivateKey=aMAG31yjt85zsVC5hn5jMskuFdF8C/LFSRYnhRGSKUQ=
MTU=1440
[Peer]
PublicKey=LyhhEIjVQPVmr/sJNdSRqTjxibsfDZ15sDuhvAQ3hVM=
AllowedIPs=172.31.192.2/32
systemctl start wg-quick@server
ืงืืืขื ื
/etc/wireguard/client.conf:
[Interface]
Address=172.31.192.2/18
PrivateKey=uCluH7q2Hip5lLRSsVHc38nGKUGpZIUwGO/7k+6Ye3I=
MTU=1440
[Peer]
PublicKey=DjJRmGvhl6DWuSf1fldxNRBvqa701c0Sc7OpRr4gPXk=
AllowedIPs=172.31.192.1/32
Endpoint=SERVER_IP:51820
systemctl start wg-quick@client
ืจืขืืืืืึทืื
ืคืืึทืื ืืืขืก ืฆืืืื
ืกืขืจืืืืจืขืจ ืงืคึผื ืืึทืกืข ืืื ื ืืฉื ืืืืขืจ ืื ืืืงืึทืืืื, ืืืืึทื ... ืขืก ืืขื ืขื ืคืืืข ืื ืืขืจืข ืืึทืืื ืื ืืก ืคืืืกื ืืืง ืืึธืจื, ืืื ืืื ืขืกื ืึทืจืืืฃ ืจืขืกืืจืกื:
proto bandwidth[Mbps] CPU_idle_client[%] CPU_idle_server[%]
# 20 Mbps ะบะฐะฝะฐะป ั ะผะธะบัะพะบะพะผะฟัััะตัะฐ (4 core) ะดะพ VPS (1 core) ัะตัะตะท ะัะปะฐะฝัะธะบั
# pure
UDP 20.4 99.80 93.34
TCP 19.2 99.67 96.68
ICMP latency min/avg/max/mdev = 198.838/198.997/199.360/0.372 ms
# ipipou
UDP 19.8 98.45 99.47
TCP 18.8 99.56 96.75
ICMP latency min/avg/max/mdev = 199.562/208.919/220.222/7.905 ms
# openvpn0 (auth only, no encryption)
UDP 19.3 99.89 72.90
TCP 16.1 95.95 88.46
ICMP latency min/avg/max/mdev = 191.631/193.538/198.724/2.520 ms
# openvpn (full encryption, auth, etc)
UDP 19.6 99.75 72.35
TCP 17.0 94.47 87.99
ICMP latency min/avg/max/mdev = 202.168/202.377/202.900/0.451 ms
# wireguard
UDP 19.3 91.60 94.78
TCP 17.2 96.76 92.87
ICMP latency min/avg/max/mdev = 217.925/223.601/230.696/3.266 ms
## ะพะบะพะปะพ-1Gbps ะบะฐะฝะฐะป ะผะตะถะดั VPS ะะฒัะพะฟั ะธ ะกะจะ (1 core)
# pure
UDP 729 73.40 39.93
TCP 363 96.95 90.40
ICMP latency min/avg/max/mdev = 106.867/106.994/107.126/0.066 ms
# ipipou
UDP 714 63.10 23.53
TCP 431 95.65 64.56
ICMP latency min/avg/max/mdev = 107.444/107.523/107.648/0.058 ms
# openvpn0 (auth only, no encryption)
UDP 193 17.51 1.62
TCP 12 95.45 92.80
ICMP latency min/avg/max/mdev = 107.191/107.334/107.559/0.116 ms
# wireguard
UDP 629 22.26 2.62
TCP 198 77.40 55.98
ICMP latency min/avg/max/mdev = 107.616/107.788/108.038/0.128 ms
20 ืืืคึผืก ืงืึทื ืึทื
ืงืึทื ืึทื ืคึผืขืจ 1 ืึธืคึผืืืืืกืืืฉ ืืืคึผืก
ืืื ืึทืืข ืงืึทืกืขืก, ipipou ืืื ืืึทื ืฅ ื ืึธืขื ื ืืื ืคืึธืจืฉืืขืืื ื ืฆื ืื ืืึทืืข ืงืึทื ืึทื, ืืืึธืก ืืื ืืจืืืก!
ืื ืึทื ืขื ืงืจืืคึผืืื ืึธืคึผืขื ืืืคึผื ืืื ืขื ืืืืืืืื ืืึทื ืฅ ืืึธืื ืข ืืื ืืืืืข ืงืึทืกืขืก.
ืืืื ืืืขืจ ืขืก ืื ืืื ืืขืืื ืืขื ืฆื ืคึผืจืืืืจื ืขืก, ืขืก ืืืขื ืืืื ืืฉืืงืึทืืืข ืฆื ืืขืจื ืืึทืืขืจืงืื ืืขื.
ืงืขื IPv6 ืืื NetPrickle ืืืื ืืื ืืื ืื!
ืืงืืจ: www.habr.com