hostapd da OpenVPN a kan Pi ɗaya: wa ke da hanyar da aka saba?

Wayoyi suna haɗawa da wurin shiga, suna karɓar adireshi, sannan ba su isa kome ba da zarar ramin ya tashi. hostapd yawanci yana da lafiya a wannan yanayin, haka ma OpenVPN; abin da ke karyewa shine hanyar da aka saba, wadda ko ba ta taɓa kasancewa a kan gadar ba ko kuma ramin ya maye gurbinta ba tare da barin hanya zuwa uwar garken VPN kanta ba. Wannan jagorar tana mayar da wannan hanya inda ta dace kuma tana tabbatar da sakamakon daga abokin ciniki maimakon daga Pi. Kowane mataki ana iya juyawa baya, kuma babu abin da ke nan da ke canza tsarin ramin har sai kun san wane zirga-zirga kuke so a cikinsa.

Yi lissafin hanyoyin sadarwa kafin ka gyara wani abu

Tsarin da aka sani yana sanya rediyo mara waya da tashar waya a cikin br0, yana fara hostapd a kan gadar kuma yana ba da haya daga dnsmasq, yayin da abokin ciniki na OpenVPN ke ƙirƙirar tun0. Sannan buƙatu uku daban-daban suna kama da ɗaya: abokan cinikin wurin shiga suna buƙatar Pi a matsayin ƙofarsu, Pi yana buƙatar hanya zuwa intanet don isa uwar garkensa, kuma gadar tana buƙatar adireshin ƙofa da waɗannan abokan ciniki za su iya amfani da shi.

Karanta halin yanzu kafin ka canza shi, domin waɗannan umarni huɗu suna raba matsalar hanyar sadarwa daga matsalar tafiyar hanya.

ip -br addr
ip route show
ip link show master br0
bridge link show

Idan br0 yana ɗauke da adireshi amma babu hanyar da aka saba, abokan ciniki suna isa Pi kuma ba kome bayansa. Idan hanyar da aka saba tana nuni zuwa tun0 yayin da ramin yana ƙasa, Pi ba shi da wata hanya mai aiki kwata-kwata, kuma alamar abokin ciniki tana kama da ita. Dukansu suna kama da juna daga waya, shi ya sa dole a karanta teburin hanya kai tsaye.

Ba gadar hanyar da aka saba wadda take nata

Raspberry Pi OS yawanci yana barin gadar ba tare da hanyar da aka saba ba lokacin da gadar ta wanzu bayan an rubuta fayil ɗin hanyar sadarwa. Sassan yana cikin /etc/dhcpcd.conf, kuma ya kamata ya ambaci na'urar da ke sama maimakon Pi.

interface br0
static ip_address=192.168.50.2/24
static routers=192.168.50.1
static domain_name_servers=192.168.50.1

A wannan misalin 192.168.50.1 shine na'urar da take akwai kuma 192.168.50.2 shine adireshin gadar Pi a cikin wannan ƙaramin cibiyar sadarwa, don haka saka naka shirin maimakon kwafin lambobin. Membobin gadar kuma kada su nemi na'urori, in ba haka ba Pi zai ƙare da hanyoyin da aka saba masu gasa waɗanda mai nasara ya dogara da awo da lokaci maimakon niyya.

Bayan systemctl restart dhcpcd ya kamata ip route show default ya lissafa br0 sau ɗaya kuma babu kwafi daga tashar waya. Tabbatar da binciken maimakon teburin, domin tsohon shigarwa na iya zama kusa da mai nasara: ip -4 route get 203.0.113.10 dole ne ya ambaci br0. Wannan adireshin ya fito ne daga kewayon takardun TEST-NET-3, don haka ba zai iya cin karo da uwar garke na gaske yayin da kake karanta wannan ba.

Hana ramin sace hanyar zuwa uwar garkensa

Abokin ciniki na OpenVPN da ya karɓi redirect-gateway yana karɓar hanyar da aka saba kuma yana turawa cikin ramin. Wannan daidai ne lokacin da kowane abokin ciniki na wurin shiga ya kamata ya yi amfani da VPN, kuma ba daidai ba lokacin da wasu wurare kawai ya kamata. Ko ta yaya, haɗin Pi da kansa zuwa uwar garke ba dole ba ya yi tafiya cikin ramin da yake gini tukuna. OpenVPN yana ƙara hanyar mai masauki zuwa nesa ta hanyar ƙofar asali lokacin da yake juya hanyar da aka saba, kuma wannan ita ce ainihin halin da ke riƙe jigilar da rai; idan wannan hanya ba ta nan, ramin yana rushewa da zarar ya tsaya.

Kwatanci mai sauri na wannan hanyar jigila kafin da bayan haɗawa ya cancanci waɗannan daƙiƙa goma. ip -4 route get 203.0.113.10 ya kamata ya ambaci na'urar ƙasa a duka yanayi biyu, kawai awo ne ke motsawa. Idan ya ambaci tun0 bayan ramin ya tashi, ba a taɓa shigar da hanyar mai masauki ba kuma sake haɗawa na gaba zai kasa.

Lokacin da kawai zaɓaɓɓun prefixes ya kamata su tsallaka ramin, yi amfani da route-nopull kuma ƙara hanyoyin da kake so da hannu, ko tura ƙaramin saiti daga uwar garke. Gadar tana riƙe da hanyar da aka saba a wannan tsarin, kuma DNS ya zama shawara ta gaba: tura dnsmasq zuwa mai warwarewar gida yana da ma'ana kawai ga sunayen da suke zaune a can da gaske.

Yanke shawara kan tura da NAT

Cikakken rami yana buƙatar tura a kunne a kan Pi da ƙofar waje da ke shirye ta yi tafiyar da ƙaramin cibiyar sadarwar wurin shiga. Duba tura kafin wani abu, domin sifili yana sa duk canjin hanya ya zama mara amfani.

sysctl net.ipv4.ip_forward
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADE

Dokar NAT ita ce gajeriyar hanya da ke aiki lokacin da uwar garke ba za ta karɓi prefix ɗin wurin shiga ba, a farashin kowane abokin ciniki ya bayyana a matsayin adireshin ramin Pi a cikin rajistan waje. Yin tafiyar da prefix ba tare da NAT yana riƙe adireshi a bayyane kuma ya dogara da hanyar dawowa ga 192.168.50.0/24 a gefen gida.

Rubuta zaɓin kusa da dokokin wuta, domin dokar NAT da ba a gani a cikin tsari tana zama mara bayani bayan wata shida. Riƙe IPv6 a cikin wannan shawara; hanyar IPv4 mai aiki kusa da karyewar hanyar IPv6 har yanzu ana karanta ta a matsayin rabin karye a cikin burauza.

Tabbatar daga abokin ciniki, sannan ka koma baya da tsabta

Gwada a wannan tsari daga waya ko kwamfutar tafi-da-gidanka a wurin shiga: haya daga dnsmasq, ping zuwa adireshin gada, sannan wani wuri a gefen nesa na ramin. Kowane mataki yana ware wani Layer maimakon samar da gazawa ɗaya mara amfani.

ip -4 route get 203.0.113.10
ping -c 3 -I br0 203.0.113.10

Sannan tabbatar da cewa Pi yana da hanyarsa ta fita: ip route get 203.0.113.10 ya kamata ya ambaci na'urar ƙasa, kuma ping -c 3 -I br0 203.0.113.10 ya kamata ya amsa idan uwar garke ta yarda da ICMP. Idan matakai biyu na farko na abokin ciniki sun wuce kuma na uku ya kasa, laifin yana cikin tura ko NAT. Idan mataki na biyu ya kasa, gada ko DHCP har yanzu bai cika ba.

Komawa baya gyara fayil ɗaya ne da umarni biyu: cire sassan, sake kunna dhcpcd, kuma maye gurbin hanyar da aka saba a fili da ip route replace default via 192.168.50.1 dev br0. Yi hakan kafin taga kulawa ta rufe maimakon bayan, domin Pi da ya rasa hanyarsa ta asali ba a iya isa gare shi daga hanyar sadarwar da za ka yi amfani da ita don gyara shi.