Haɗa abokan ciniki biyu na OpenVPN a kan mai masaukin Linux ɗaya da fwmark

Ƙara wani abokin ciniki na biyu na OpenVPN a kan mai masaukin Linux guda ɗaya yana kasawa a ɗaya daga wurare biyu. Ko abokin ciniki na ciki ba zai iya isa ga nasa uwar garke ba saboda ramin waje ya kama wannan jigilar, ko kuma abokin ciniki na biyu ya sake rubuta teburin hanya kuma ramin farko ya daina aiki. Duk matsalolin biyu suna cikin tsarin hanya ne, ba cikin ɓoyewa ba, kuma ana magance su biyu kafin sabon ramin ya ɗauki wani zirga-zirgar manhaja. Adiresoshin nan misali ne: tun0 shine ramin waje, 203.0.113.9 shine uwar garke ta ciki, kuma TCP 9999 shine kwararar da dole ta yi amfani da hanyar ciki.

Hanyoyin kasawa guda biyu, teburin hanya guda

Abokin ciniki na ciki yana buɗe soket ɗin UDP zuwa uwar garkensa, kuma wannan soket ɗin yana bin teburin hanya na yanzu kamar kowane. Idan ramin waje ya riga ya mallaki tsohuwar hanya, fakitin musafaha suna shiga cikin ramin waje. Hakan yana aiki ne kawai idan uwar garke ta waje za ta iya isa ga uwar garke ta ciki kuma gefen can ya yarda ya ɗauki kwararar; in ba haka ba musafaha takan tsaya kuma abokin ciniki ya sake gwadawa.

Kasawar ta biyu tana zuwa daga turawar uwar garke. Turawar da aka saba ita ce redirect-gateway def1, wadda ke sanya 0.0.0.0/1 da 128.0.0.0/1 maimakon maye gurbin tsohuwar hanya. Don haka abokan ciniki biyu da kowanne ya sanya nasa nau'in /1 suna cin karo, kuma sabon nau'in yana cin nasara ga kusan kowace manufa. Duba waɗannan prefix biyu a cikin tebur lokacin da rami ya mutu bayan na biyu ya haɗu, domin watakila tsohuwar hanya kanta ba ta taɓa canzawa ba.

Yi wa kwararar alama ka ba ta teburi

Sarrafa zirga-zirgar da aka zaɓa ta hanyar yin mata alama a cikin teburin mangle da daidaita alamar a cikin ƙa'idar manufa. Ƙa'idar tana nuni ga wani teburi na musamman wanda tsohuwar hanyarsa ita ce na'urar ciki, don haka fakitin da aka yi wa alama ne kawai ke bin hanyar ciki.

iptables -t mangle -A PREROUTING -p tcp -m multiport --dport 9999 -j MARK --set-mark 0x9999
ip rule add fwmark 0x9999 table 200 pref 1000
ip route add default dev tun1 table 200

Yawancin kasawa a cikin wannan rukunin ƙa'idoji suna zuwa daga kurakurai biyu. Ƙimar alamar da firewall ya saita da ƙimar da ƙa'idar ta daidaita dole su zama ɗaya, domin rashin daidaituwa ba ya haifar da kuskure ko wani tasiri. Kuma PREROUTING yana ganin fakitin da suka fito daga waje ne kawai, don haka haɗin da ya fara a wannan mai masaukin yana buƙatar ƙa'idar OUTPUT mai daidaitaccen ma'auni kafin a yi masa alama kwata-kwata.

Karɓi mallakar hanya daga abokin ciniki na biyu

Zaɓuɓɓuka biyu suna hana abokin ciniki na biyu gyara teburin, kuma suna aiki a wurare daban-daban. route-nopull yana watsi da zaɓuɓɓukan hanyar da aka tura, don haka ba a sanya komai. route-noexec yana karɓar zaɓuɓɓukan da aka tura cikin muhallin abokin ciniki amma yana barin canjin tebur ga hook, wanda shine abin da kuke so lokacin da kuke buƙatar ganin abin da uwar garke ta bayar.

Hook ɗin yana gudana da ƙimar da aka tura a cikin muhallinsa, kuma ya kamata ya ƙara shigarwar da kuka amince da su kawai. Ka mai da shi idempotent: share teburin da ya mallaka kafin sake ginawa, kuma kada ka ɗauka cewa gudun da ya gabata ya bar yanayi mai tsabta. Sake haɗuwa yana kira ga hook ɗin kuma, kuma hook da ke ƙarawa ba tare da sharewa ba yana tara hanyoyi masu kwafi.

Zaɓi mai shi ɗaya ka rubuta shi. Bayanin da ke saita zaɓuɓɓukan biyu, ko hook da ke fafatawa da rubutaccen script, yana samar da teburin da babu wanda zai iya bayyana shi daga baya.

Ɗaure adiresoshin uwar garke biyu

Uwar garke ta ciki tana buƙatar hanyar host ta na'urar waje kafin abokin ciniki na ciki ya haɗu. Wannan shigarwa ce ke riƙe jigilar ciki cikin ramin waje maimakon barin ta ta bi tsohuwar hanya.

ip route add 203.0.113.9/32 dev tun0
ip route get 203.0.113.9

Ƙara hanyar host mai daidaitawa don uwar garke ta waje a cikin babban teburi kuma, in ba haka ba sake haɗuwa na iya tura jigilar abokin ciniki na waje cikin nata rami. Tsari ba zaɓi ba ne: ƙara waɗannan shigarwar bayan ingantaccen interface ya wanzu, wato hook ko script da ke gudana bayan haɗuwa. Hanyar da ke nuni ga na'urar da ta kasance a kashe ana cire ta ko a watsi da ita, don haka shigarwar da aka rubuta a lokacin tashin na'urar ba ta wuce jerin da kuka yi tsammani ba.

Duba binciken maimakon karanta dukan teburin. Fitowar binciken hanya tana ambaton na'urar da adireshin tushen da kernel zai yi amfani da su, wanda shine ainihin abin da abokin ciniki ke samu lokacin da ya buɗe soket ɗinsa.

Gwada sarkar kuma ka sa kasawa ta bayyana

Riƙe abin kamawa a interface na waje yayin da abokin ciniki na ciki ke haɗuwa. Musafahar ta ciki ya kamata ta bayyana a matsayin kaya mai ɓoye cikin ramin waje; idan ta bayyana a matsayin UDP kawai zuwa 203.0.113.9, hanyar host ba ta nan kuma ba a taɓa gina sarkar ba.

Sarkar da ke komawa a hankali zuwa uplink na zahiri ita ce mafi munin sakamako, domin yanayin interface ba ya sanar da komai kuma zirga-zirgar ciki tana fita daga kuskuren adireshin tushe. Idan abokin ciniki na biyu zai iya sake haɗuwa kai tsaye lokacin da ramin waje ya faɗi, kashe wannan hanyar ko ɗaure ta ga interface na waje domin kasawar ta bayyana.

Kammala da kwararru biyu da dump ɗin ƙa'ida ɗaya: haɗin da aka yi wa alama da wanda ba a yi wa alama dole su bi hanyoyi daban, kuma ip rule show ya kamata ya lissafa fifikon da kuka yi niyya. Idan dukan kwararrun biyu suna bin hanya ɗaya, ba a sanya alamar a inda kuke tsammani ba.