Masquerade ko tafiyar da hanya bisa manufa: zirga-zirgar LAN ta ƙofar VPN

Sanya dukan LAN a bayan ramin VPN shi ne sashe mai sauƙi; yanke shawara kan yadda gefen nesa yake ganin waɗannan abokan ciniki ba haka ba ne. Masquerade yana sake rubuta kowane tushen LAN zuwa adireshin ramin ƙofar, don haka gefen nesa yana amsa wa ɗan takwara ɗaya. Tafiyar da hanya bisa manufa tana riƙe adiresoshin asali kuma tana buƙatar gefen nesa ya san yadda zai isa gare su. Babu ɗayan da yake tsohuwar dabi'a; zaɓin ya biyo daga wanda ya mallaki gefen nesa da ko asalin kowace na'ura yana da muhimmanci.

Zane-zane biyu suna yin alkawuran daban-daban

Masquerade yana rage LAN zuwa ga mai masauki ɗaya da ake gani: ƙofar. Cibiyar sadarwar nesa tana amsa wannan adireshi ɗaya, kuma ƙofar tana fassara amsoshin zuwa ga abokin ciniki da ya fara kwarara. Babu buƙatar hanya zuwa manyan lambobinka na sirri a gefen nesa, shi ya sa wannan zane yake jure wa mai ba da sabis da ya ƙi ɗaukar su. Ƙofar kuma ta zama tushen kowane haɗi, don haka gefen nesa ba zai iya bambanta abokan ciniki biyu ba.

Tafiyar da hanya bisa manufa tana riƙe adireshin kowane abokin ciniki cikakke. Cibiyar sadarwar nesa tana ganin ainihin tushen kuma tana iya rubuta shi, amfani da ƙa'ida ga kowane mai masauki ko aika amsar kai tsaye zuwa wannan adireshin. Wannan ganuwa ita ce dukan manufar, kuma tana zuwa da wajibci: dole gefen nesa ya sami hanyar zuwa farkon LAN da ke komawa ta cikin ramin. Tsara wannan hanya kafin ka kunna ƙa'idar, domin ramin zai tashi ko ta yaya kuma amsoshin ne kawai za su ɓace.

Hanyoyin gazawa sun bambanta kamar yadda alkawuran suka bambanta. Ƙa'idar masquerade da babu ita tana haifar da fakiti da ke fita da tushe na sirri kuma ba sa dawowa. Hanyar dawowa da babu tana haifar da alamar nan ɗaya a ƙarƙashin tafiyar da hanya bisa manufa, amma gyaran ya rataya ga na'urar hanya ta nesa ba ga ƙofar ba.

Masquerade: ɗan takwara ɗaya a gefen nesa

Hanyar masquerade tana da tsari wanda ke da muhimmanci. Dole a kunna tura fakiti gaba kafin kowace ƙa'idar NAT ta yi wani amfani, dole teburin tacewa ya yarda da wucewa a duka kwatance biyu, sannan kawai fassarar ta aiki a kan muƙamin ramin.

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Abokan ciniki har yanzu suna buƙatar hanya zuwa ƙofar. Ko dai ƙofar ita ce na'urar hanyarsu ta asali, ko kuma suna ɗauke da takamaiman hanya zuwa farkon nesa; idan wata na'urar hanya daban ta kasance ta asali, wannan na'urar tana buƙatar tsayayyiyar hanya zuwa wuraren ramin, in ba haka ba fakitin zai je ga tsallakewar da ba daidai ba kafin ƙofar ta gan shi.

DNS yanke shawara ce daban. Mai warwarewa a gefen nesa yana amsa ne kawai idan amsarsa za ta iya komawa ga abokin ciniki. A ƙarƙashin masquerade tambayar tana kama da ta fito daga ƙofar, don haka hanyar dawowar mai warwarewa ta riga ta cika; a ƙarƙashin tafiyar da hanya bisa manufa mai warwarewa yana buƙatar hanyar dawowa ɗaya da duk wata hidima ta nesa.

Tafiyar da hanya bisa manufa: riƙe tushen, ƙara hanyar dawowa

Tafiyar da hanya bisa manufa tana farawa da teburi da ƙa'ida da ke zaɓe shi. Zirga-zirgar da ke shigowa daga muƙamin LAN ana tura ta zuwa wani teburi na musamman, kuma wannan teburin yana ɗauke da tsohuwar hanya ta cikin ramin. Babban teburin ya kasance ba a taɓa shi ba, don haka zirga-zirgar da ƙofar da kanta ta haifar na iya bin wata hanya daban.

ip rule add iif eth1 table vpn
ip route add default dev tun0 table vpn

Sannan gefen nesa dole ya tafiyar da farkon LAN da baya ta cikin ramin. Wannan saiti ne a kan na'urar hanya ta nesa, ba a kan wannan ƙofar ba. Ƙofar kuma dole ta karɓi amsoshin da ke zuwa a wani muƙami daban da wanda babban teburin zai yi tsammani; sako-sakon tacewar hanyar baya (rp_filter an saita zuwa 2) shi ne gyaran da aka saba idan tsayayyen yanayi ya watsar da waɗannan fakiti.

Idan ramuka biyu suna aiki, yi wa kowane kwarara alama lokacin da ya shigo kuma bar alamar ta zaɓi teburin. Ƙa'idar da ke kallon muƙamin shigowa kawai tana tura zirga-zirgar ramukan biyu zuwa teburi ɗaya, don haka rami na biyu yana sace kwararar na farko. Gwada wannan alamar da haɗin da zai jure sake haɗawa, domin a lokacin ne tsarin gauraye ke bayyana.

Yanke shawara bisa mallaka da bisa abin da gefen nesa ke rubutawa

Idan ramin ya ƙare a wurin mai ba da sabis, yi amfani da masquerade. Wannan mai gudanarwa ba zai tafiyar da manyan lambobinka na LAN ba, kuma ba shi da dalilin bambanta ɗaiɗaikun abokan ciniki a bayan ƙofarka. Ɗan takwara ɗaya da ake gani shi ne kawai tsarin da manufarsa ke goyon baya, don haka ba shi haka kuma ka riƙe fassarar a gefenka. Mai ba da sabis yana ganin ɗan takwara ɗaya, wanda shi ne ainihin abin da manufarsa ke tsammani, kuma abokan cinikinka suna gado wannan asali ɗaya.

Idan duka ƙarshen biyu naka ne kuma hidimomin nesa suna aiki bisa adireshin tushe, tafiyar da hanya bisa manufa ta cancanci ƙarin hanyarta. Sa'an nan ƙa'idodin katangar wuta, shiga ga kowane mai amfani da bayanan dubawa za su iya bambanta abokan ciniki. Idan gefen nesa yana buƙatar isa kawai, masquerade ya fi sauƙi kuma yana kawar da wani nau'in kurakurai na hanyar dawowa.

Zane-zanen gauraye abu ne na yau da kullum: tafiyar da hanya bisa manufa a cikin cibiyar sadarwarka, masquerade a gefen mai ba da sabis. Abin da ke da muhimmanci shi ne rubuta wane tsallakewa ke fassarawa da wane tsallakewa ke tafiyar da hanya, domin ƙa'idar NAT da aka ƙara bisa kuskure ga abokin ciniki ɗaya tana ɓoye tushen ga kowane abokin ciniki a cikin sarkar ɗaya.

Tabbatar daga abokin ciniki ɗaya, sannan daga abokin ciniki na biyu

Gudanar da gwajin a inda zirga-zirgar ke farawa. Duba hanyar da mai masaukin ke amfani da ita, kalli yadda fakitin ke bayyana a muƙamin ramin, kuma duba conntrack don fassarar. Wannan jeri yana tabbatar da fakitin ya bi hanyar da aka nufa maimakon ya isa wani wuri kawai.

Sake gwajin bayan sake haɗawa. Ƙa'idar masquerade da ke ambaton muƙamin tana jure wa sabon adireshin rami; ƙa'idar da ke ambaton tsohon adireshin ba ta jurewa. Sannan gwada wani mai masauki na biyu na LAN, domin zanen da ke aiki a na'ura ɗaya sau da yawa ya dogara da hanyar wannan na'urar ba da manufar ƙofar ba.

Rubuta tsarin da aka zaɓa, tushen da aka fassara ko aka ajiye da mai hanyar dawowa a cikin bayanan ƙofar. In ba haka ba mutumin da zai ƙara abokin ciniki ko rami zai yi hasashe, kuma hasashe shi ne yadda ingantaccen tsarin LAN-zuwa-VPN ke zama mai ɓangare.