Ƙara subnet na biyu zuwa VPN tsakanin wurare: hanyoyi biyu
Tunnels na tushen manufa suna buƙatar masu zaɓe daidai a ɓangarorin biyu; na tushen hanya suna buƙatar hanya. Zaɓi hanyar da ta dace kuma gyara hanyar dawowa da farko.
Ƙara subnet na biyu zuwa tunnel mai aiki tsakanin wurare yana ɗaukar minti biyar a wata ƙira kuma kusan dukan yamma a ɗayan. Sa’ad da tunnel ɗin ya shigar da hanyoyi don prefixes ɗin da ka ambata, kana ƙara hanya kuma zirga-zirgar tana bin ta. Sa’ad da yake yin shawarwari kan tsayayyen nau’in masu zaɓe guda ɗaya, sabon prefix ɗin yana zama ba tare da kariya ba har sai ɓangarorin biyu sun amince da nau’i mai dacewa. Abubuwa uku ne ke yanke hukunci: abin da saitin kowane ɓangare yake bayyanawa da gaske, ko ana taƙaita zirga-zirgar da aka yi shawarwari zuwa ƙaramin nau’i mai dacewa, da wanda ya mallaki hanyar dawowa ga sabon kewayon.
Karanta kernel, ba alamar matsayi ba
Tunnel ɗin da ke bayar da rahoton an haɗa shi ya shigar da aƙalla ƙungiyar yaro ɗaya, amma ba lallai ba ne wadda kake tsammani. A Linux kernel ɗin yana nuna abin da ake amfani da shi: ip xfrm policy yana lissafa nau’in masu zaɓe, kuma swanctl --list-sas (ko tsohon ipsec statusall) yana nuna abin da ɓangarorin suka yi shawarwari, har da masu zaɓen zirga-zirga a kowace hanya. Idan sabon prefix ɗin bai bayyana a kowane ba, ba shi da kariya, ko da me fayil ɗin saitin ya ce.
Kwatanta wannan da teburin hanyoyi. A tsarin tushen hanya, na’urar tunnel ita ce mataki na gaba ga prefixes ɗin da aka kare. Tsarin tushen manufa sau da yawa ba shi da takamaiman hanya ga subnet ɗin nesa, sai hanyar da aka saba, domin manufar ce ke zaɓar zirga-zirga ba teburin ba.
Tunnels na tushen manufa: dole ɓangarorin biyu su lissafa sabon prefix
A cikin kalmomin strongSwan mai zaɓe yana zaune a local_ts da remote_ts ƙarƙashin saitin yaro, magada leftsubnet da rightsubnet. Sabon prefix ɗin dole ya bayyana a ɓangarorin biyu daidai: abin da wurin A ya kira na gida, wurin B yana kiransa na nesa. Rashin daidaituwa ba safai yake bayar da tsaftataccen kuskure ba. Ɗayan suna raguwa zuwa mahaɗin, tsohon prefix ɗin yana ci gaba da aiki kuma sabon ɗin yana kasawa cikin shiru.
swanctl --load-conns
swanctl --initiate --child <child-name>
swanctl --list-sas
ip xfrm policyA pfSense ko OPNsense wannan yana nufin wani shigarwar Phase 2 na biyu da ke haɗa sabon subnet ɗin gida da sabon na nesa, sannan a yi amfani. Ka riƙe tsohuwar shigarwar; maye gurbinta yana motsa asalin subnet ɗin maimakon ƙarawa. Idan wata Phase 2 da take akwai ta riga ta rufe supernet kamar 0.0.0.0/0 ko taƙaitaccen kewayo, kada ka ƙara ƙaramin shigarwa a gefensa: masu zaɓe masu haɗuwa suna shigar da manufofi masu gasa kuma tsarin kimantawa ne ke yanke wanda zai ci.
IKEv1 yana mai da kowane nau’in subnet Phase 2 nasa, kuma ɓangaren da ya karɓi nau’i ɗaya a kowace musayar yana watsi da sauran. IKEv2 na iya ɗaukar nau’in masu zaɓe da yawa a cikin yaro ɗaya, amma sai idan duka aiwatarwar sun karɓa. Lissafin daga swanctl --list-sas shine gaskiya; abin da ka rubuta buƙata ce.
Tunnels na tushen hanya: hanya ce manufar
Interface na XFRM ko na’urar VTI tana ɗaukar zirga-zirga bisa ga teburin hanyoyi. Kana nuna sabon prefix ɗin zuwa na’urar a wuraren biyu, kuma matsayin da ke daure da sauyin interface ɗin yana aiki. Babu nau’in masu zaɓe da za a daidaita, shi ya sa wannan ƙirar take ƙaruwa da kyau yayin da subnets ke yawa. Jagorar isar da strongSwan tana bayani kan ɓangaren kernel daki-daki.
ip route add 192.168.60.0/24 dev xfrm0
ip route get 192.168.60.10WireGuard yana ci gaba da wannan tunani. AllowedIPs shi ne lissafin izini na crypto a lokaci ɗaya kuma, ta wg-quick, shigarwar teburin hanyoyi. Ƙara prefix ɗin a ɓangare ɗaya kawai sai ka sami musafaha, fakiti masu fita da shiru, domin ɓangaren nesa yana watsi da fakiti waɗanda tushensu ba ya cikin lissafinsa. Siffar wg set tana maye gurbin dukan lissafin, don haka sake ambaton prefixes ɗin da suka riga suka yi aiki in ba haka ba za ka yanke su:
wg set wg0 peer <PUBKEY> allowed-ips 192.168.10.0/24,192.168.60.0/24
ip route add 192.168.60.0/24 dev wg0Wannan umarni na biyu ba zaɓi ba ne sa’ad da ka yi amfani da wg set maimakon wg-quick. Kernel ɗin yana karɓar sabon lissafin nan take, amma babu abin da ke ƙara hanya dominsa, don haka zirga-zirgar da aka ƙirƙira a gida har yanzu tana fita ta hanyar ƙofar da aka saba. Wannan shi ne dalilin da ya fi yawa da sabon subnet ɗin WireGuard ke aiki daga mai karɓar bakuncin tunnel ba daga kwamfutar tafi-da-gidanka ba.
Hanyar dawowa tana kasawa fiye da tunnel
Mai karɓar bakuncin a sabon subnet ɗin nesa dole su aika amsoshi ta ƙofar VPN. Idan wannan ƙofar ba ita ce mai tuƙin su na asali ba, amsar tana zuwa ga mai tuƙin LAN, wanda ko yana watsi da ita ko yana tura ta zuwa intanet da adireshin tushe na sirri. Gwada daga mai karɓar bakuncin a ɓangaren nesa ba daga ƙofar ba: ip route get 10.30.20.15 a Linux ko Find-NetRoute -RemoteIPAddress 10.30.20.15 a PowerShell yana nuna mataki na gaba da mai karɓar bakuncin zai yi amfani da shi da gaske. Idan amsar ba ita ce ƙarshen tunnel ɗin ba, ƙara tsayayyen hanya ga sabon prefix ɗin a can.
NAT na tushe a wurin da ba shi da hanyar dawowa wata hanya ce ta halal kuma yadda yawancin tsare-tsaren hub-and-spoke ke guje wa taɓa kowane uwar garke. Yi amfani da shi ga sabon prefix ɗin a ƙofar ɓangaren manufa kuma:
iptables -t nat -A POSTROUTING -s 10.30.20.0/24 -d 192.168.60.0/24 -j MASQUERADEKuɗin gaskiya ne. Bayanan nesa sun daina nuna adiresoshin tushe ɗaya-ɗaya, kuma dokokin wutar bango da suka dogara da asalin subnet ɗin suna ruɗewa zuwa doka ɗaya ga ƙofar. Zaɓi hakan da gangan, ba don an rasa hanya ba.
Wutar bango ita ce sauran rabin hanyar dawowa. Na’urorin tushen yanki ba sa faɗaɗa yankin interface ɗin tunnel da ke akwai zuwa sabon subnet kai tsaye, kuma dokar da aka rubuta don tsohon prefix ɗin ba za ta dace ba. Ƙara sabon subnet ɗin cikin yankin ko cikin nau’in dokoki a duka hanyoyi biyu kafin ka zargi IPsec.
Yanke shawara da tambayoyi uku, sannan tabbatar da zirga-zirga
Taƙaitaccen sigar: shin saitin ɓangaren yana ambaton prefixes (tushen manufa), ko ana tura zirga-zirga cikin interface (tushen hanya)? Shin dukan ƙarshen biyu suna lissafa sabon prefix ɗin? Shin akwai hanyar dawowa daga sabon subnet ɗin zuwa asalin kewayon tushe?
| Tunnel style | Where the prefix goes | What breaks if you skip it |
|---|---|---|
| Policy-based IPsec | Selector pair on both peers | Old subnets work, the new one fails with no clear error |
| Route-based XFRM or VTI | Route into the device on both sites | Packets routed but not transformed, or the state never matches |
| WireGuard | AllowedIPs on both peers plus a route | Handshake succeeds, replies are dropped |
| Overlapping supernet | Adjust the existing entry instead | A shadowed policy wins or loses by evaluation order |
Tabbatarwa ita ce wurin da yawancin canje-canje ake rufewa da wuri. Ping daga ƙofar yana tabbatar da kaɗan, domin ƙofar tana aikawa daga kanta kuma sau da yawa tana dacewa da wata manufa daban fiye da mai karɓar bakuncin. Yi ping daga mai karɓar bakuncin a sabon subnet ɗin, sannan ka gudanar da aikace-aikacen da ya sa aka yi canjin, kuma ka duba ƙididdiga ba alamar matsayi ba.
tcpdump -ni any host 192.168.60.10 and (esp or udp port 4500)
ip xfrm state
wg showA tunnel na tushen manufa ƙididdigan ip xfrm state ya kamata su haura a duka hanyoyi biyu; ƙididdiga marasa motsi suna nufin an tura fakiti amma ba a zaɓe shi ba. A WireGuard, wg show yana bayar da rahoton canja wuri ga kowane ɓangare, kuma musafaha da sifili bytes da aka karɓa yana nuni ga lissafin ɓangaren nesa ko hanyar dawowarsa.
Kammala ta hanyar rubuta prefix ɗin, mai zaɓe ko hanyar ɓangaren, shawarar hanyar dawowa da shigarwar wutar bango tare da sauran lissafin tunnel ɗin. Sannan sake tayar da ƙofa ɗaya ka sake gwadawa: hanyar da aka ƙara da hannu tana ɓacewa, kuma mutum na gaba bai kamata ya sake gano hakan ba.