Bar Abokin Ciniki Ɗaya na OpenVPN ya yi SSH zuwa Wani Ba tare da Buɗe Rijiyar Ba

Wani abokin ciniki yana buƙatar isa sabis ɗin SSH na wani abokin ciniki, kuma sauran rijiyar ya kamata ya kasance a keɓe kamar yau. Maɓallin da ke jan hankali shi ne client-to-client, wanda ke kunna isa tsakanin takwarorinsu ga kowa a lokaci ɗaya kuma ya ba da shawarar ga OpenVPN maimakon kernel. Amsa mafi ƙunci tana barin wannan maɓallin a kashe kuma tana barin turawa da katangar wuta na uwar garke kanta su ɗauki rafi ɗaya daidai.

Hanyar aiki ta fi rubutun dokar muhimmanci, domin hanyoyin biyu suna ajiye fakitin a wurare daban-daban. Sanin wanda ka zaɓa yana bayanin dokar da take kamar ba ta yin komai da kuma takwarar da ke haɗawa ba tare da ita ba.

Inda client-to-client ke motsa fakitin

Yayin da client-to-client yake kunne, uwar garke tana tura fakitin takwara cikin gida maimakon mayar da shi waje ta na'urar rami, don haka fakitin ba ya taɓa isa hanyar turawa ta kernel. Wannan yana da sauƙi kuma yana nufin katangar wutarka ba ta taɓa ganin rafin da ya kamata ta kula ba. Bar zaɓin a kashe kuma uwar garke tana tura fakitin baya waje ta wannan hanyar haɗi, wanda ke sa shi gaban netfilter. Hanyar haɗi ɗaya ta shiga, ɗaya ta fita, kuma sarkar FORWARD ce ke da murya.

Musanya a bayyane take: kana samun aya ɗaya ta manufa kuma kana ɗaukar aikin turawa da tura waje da gajeriyar hanya ke yi maka. Wannan aikin ƙarami ne ga rafi ɗaya kuma yana girma da kowace keɓancewar da ka ƙara. Ƙirga keɓancewar yanzu, domin saitin doka shi ne inda manufar tsakanin takwarori take a zahiri.

Hanyar da fakitin takwara ke bi a zahiri

A ɗauka sabis ɗin Linux Community OpenVPN 2.6, aikin TUN a sararin mai amfani maimakon DCO, tsarin subnet, tun0, da rijiyar 10.44.0.0/24 tare da abokin ciniki A a 10.44.0.21 da abokin ciniki B a 10.44.0.37. Da tsarin subnet adireshi da mask ɗin da A ya samu sun riga sun rufe rijiyar, don haka A yana aika fakitin zuwa na'urar rami ba tare da buƙatar ƙarin hanyar da aka tura ba. Duba ainihin hanyar a kan A maimakon ɗauka ɗaya.

A kan uwar garke fakitin yana zuwa an yi masa adireshin B, wanda ba adireshin gida ba ne, don haka ana tura shi. Dole a kunna turawa IPv4 don hakan ya faru kwata-kwata, kuma neman hanya dole ya aika fakitin baya waje ta tun0. Don haka katangar wuta tana ganin rafin da aka tura tare da hanyar haɗi ɗaya a ɓangarorin biyu, kuma wannan shi ne dallailin da yawancin saitin doka ke wucewa. Babu buƙatar fassarar tushe a nan, kuma kiyaye adireshin A cikakke shi ne ke ba B damar amfani da nasa dokar da ta dogara kan tushe.

Dokoki biyu a kan uwar garke, a wannan tsari

Dokoki uku ne ke ɗaukar dukan izinin: turawa, keɓancewar ma'aurata, da watsi na asali ga ma'auratan rami. Dokar karɓa tana ambaton ma'auratan da sabis ɗin, don haka izinin yana jure wa rijiyar da ke girma. Sanya shi gaban duk wani ƙin yarda na gama-gari ga zirga-zirgar rami-zuwa-rami, domin daidaitawar farko ce ke yin nasara:

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i tun0 -o tun0 -s 10.44.0.21 -d 10.44.0.37 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -i tun0 -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tun0 -o tun0 -j DROP

Waɗannan umarni misali ne kuma na cikin hanyar da uwar gidanka ke amfani da ita don adana dokoki; shigar da ake yi a lokacin aiki yana ɓacewa a tashin gaba. Dokar da ke da yanayi ita ce ke barin amsoshin B da musafaha na TCP su dawo ba tare da wata karɓa ta biyu da aka kwatanta ba.

Duba masu ƙirga bayan haka maimakon jerin dokoki, domin dokar da ba ta taɓa daidaitawa tana kama da wadda ke aiki. Idan masu ƙirgan sun tsaya a sifili, fakitin ba ya bin hanyar da kake tsammani.

Abin da B ya kamata ya har yanzu ya yarda

B ce ke tafiyar da sabis ɗin SSH, don haka B ce ke yanke shawara ko wani abu yana saurare a adireshin rami kuma ko katangar wutar uwar gidansa tana karɓar tushen. Izinin cibiyar sadarwa a kan uwar garke ba izini ba ne ga kowane asusu a B, kuma tabbatar da maɓallin uwar garke da tabbatar da mai amfani suna aiki kamar daga kowane wuri.

Gwada yanayin tabbatacce da farko: sabuwar haɗin SSH daga A zuwa adireshin rami na B, an karɓa da maɓallin uwar garke da ake tsammani. Sannan gwada wani takwara ko wata tashar, ka tabbatar an ƙi shi, domin izinin da ke yarda da komai a shiru ba ya bambanta da wanda ke aiki har sai ya zama muhimmi. Ɓangarorin biyu na wannan gwajin suna da muhimmanci, kuma na biyu shi ne mutane ke tsallakewa.

Rubuta adiresoshin da aka ba da, hanyoyin da suke aiki a duka abokan ciniki biyu da ainihin dokoki a kan uwar garke da kuma a kan B. Ping mai nasara zuwa ƙofar ko buɗaɗɗiyar tasha a kan uwar garke ba ta tabbatar da kome daga cikin waɗannan, domin duka biyu na iya zama gaskiya yayin da ake tura tsakanin takwarori har yanzu a toshe. Rubuta waɗannan lambobin yayin da ramin yake a buɗe, domin adireshin da abokin ciniki ke samu bayan sake haɗawa na iya zama wani.