NAT a uwar garken VPN ko a na'urar router? Dukansu suna iya aiki

Yi wa haɗi alama a matsayin tushen hanya na asali a kwamfutar tafi-da-gidanka shi ne matakin da kowa ke tunawa, kuma shi ne wanda ba ya canza komai a ƙofar. Abokin ciniki yanzu yana aika buƙatun Intanet cikin ramin; ko za su bar ginin ya dogara da turawa gaba, wurin fassara da hanyar dawowa da ke isa adireshin sirri na abokin ciniki. Shirye-shirye biyu za su iya samar da duka uku, suna ajiye aikin a wurare daban-daban, kuma dukansu suna kasawa a hanya ɗaya ta shiru idan babu wanda ke da alhakin alkiblar amsa. Zaɓi tsakaninsu tambaya ce game da wanda ya kamata ya ga tafkin abokan ciniki.

Tatsuniya: hanyar abokin ciniki tana gina mafita

Tunelin tilas manufa ce ta ɓangaren abokin ciniki: tana yanke shawarar cewa zirga-zirga za su je adaftar VPN maimakon ta jiki. Takardun Microsoft game da tafiyar VPN sun bayyana wannan rabuwa da halin tilastawa, kuma magana ce game da allon hanyoyi na abokin ciniki, ba game da ka'idojin turawa gaba na uwar garke ba. A ganin abokin ciniki ramin shi ne wurin da Intanet ke zaune; a ganin ƙofar, fakiti ya zo daga adireshin da babu wanda a sama ya taɓa jin labarinsa. Babu ɓangare da ba a daidaita shi ba shi kaɗai, kuma shi ya sa gazawar ke kama da uwar garke da ta lalace ga wanda ke gefen kwamfutar.

Wannan rashin daidaituwa ita ce dukan matsalar da sauran wannan labarin ke warwarewa. Wani abu dole ya mai da adireshin sirri na abokin ciniki abin dawowa, kuma zaɓin shi ne a ina.

Da farko zana hanyar amsa

Rubuta hanyar da adireshi na gaske kafin ka taɓa kowane saiti, kuma yi alama wurare biyu masu yiwuwar fassara a kanta. Wannan dakin gwaji yana amfani da tafkin VPN na 10.70.0.0/24 da abokin ciniki ɗaya a 10.70.0.37, adireshin LAN na uwar garke 172.16.40.10, router a 172.16.40.1 da mafitar jama'a 203.0.113.40.

client 10.70.0.37 -- tunnel --> RRAS 172.16.40.10 -- LAN --> router 172.16.40.1 --> 203.0.113.40
                                  (translate here?)                             (or here?)

Uwar garken da ke shiga Intanet tuni tana tabbatar da hanyarta kaɗai. Fakitin da aka tura gaba a madadin abokin ciniki wata shawara ce daban, wadda manufar turawa gaba a kan na'urar ɗaya ta yanke, kuma ita ce yawanci ta ɓace. Yi wa wuraren yanke shawara uku alama a zanen yana riƙe tattaunawa kan ɗayansu a lokaci ɗaya.

Zaɓi A: fassara a uwar garken VPN

A nan uwar garke tana fassara tushen abokin ciniki zuwa adireshin LAN nata kafin ta miƙa fakitin ga router, kuma router ɗin yana amfani da fassararsa ta yau da kullum a hanyar fita. A kan amsa, taswirar router ɗin tana maido da adireshin uwar garke, taswirar uwar garke kuma tana maido da adireshin abokin ciniki. Fassara biyu masu yanayi a jere al'ada ce kuma mai yiwuwa, matuƙar an rubuta duka biyun; router ɗin ba ya buƙatar hanya zuwa tafkin, kuma wannan shi ne jan hankalin wannan shiri.

Get-RemoteAccess | Select-Object VpnS2SInterface, RoutingDomain
Get-NetNat | Select-Object Name, InternalIPInterfaceAddressPrefix

Yi amfani da waɗannan karatun don ganin abin da uwar garke ke da shi tuni maimakon ɗauka cewa akwai NAT. Ka'idar masquerade ta Linux da aka kwafa daga bulogi ba saitin Windows ba ne, kuma izini a bangon wuta na mai masauki don mai sauraron VPN ba manufa ɗaya ba ce da izinin tura buƙatar abokin ciniki gaba. Tabbatar da aikin turawa gaba na uwar garke daga fuskarta ta gudanarwa, sannan ka duba fassara daban, domin sassa daban-daban na turawa sukan kunna su biyu.

Zaɓi B: ɗaukar tafkin zuwa router

A shiri na biyu uwar garke tana tura ainihin adireshin tushen abokin ciniki gaba, kuma router ɗin yana fassara shi. Hakan yana riƙe tafkin abokan ciniki a bayyane a gefen, wanda ke taimakawa idan router ɗin shi ne wurin da manufar zirga-zirga, rubutun ajiya ko dubawa suke. Hakan kuma yana nufin router ɗin yana buƙatar hanyar dawowa don 10.70.0.0/24 da ke nuni zuwa 172.16.40.10, da kuma manufar Intanet da ta haɗa da wannan prefix ɗin da gaske; ka'idar da aka rubuta don subnet ɗin LAN ba ta faɗaɗa zuwa tafkin cikin shiru.

Zaɓi wannan idan na'urar gefen ita ce mai manufar da aka nufa kuma za ta iya karɓar wani prefix a cikin allunan tafiyarta da fassararta. Zaɓi fassara ta ɓangaren uwar garke idan tafkin ya kamata ya kasance marar gani a sama kuma ba ƙungiya ɗaya ke kula da router ɗin ba. Babu zaɓi da ake samu daga kowane akwatin zaɓi a kan abokin ciniki, kuma babu wanda ya fi tsaro gaba ɗaya; suna ajiye ganuwa da kulawa a wurare daban-daban.

Bayyana DNS, IPv6 da karɓa

Fassarar adireshi ba ta gyara warware suna. Abokin ciniki na iya amfani da mai warware da aka kawo tare da bayanin martabar VPN, mai warware na sirri don wasu wuraren suna, ko wanda aka amince da shi na jama'a, kuma mai warware da ba a iya isa gare shi a ƙarƙashin wannan manufar zai ci gaba da kasawa bayan tafiyar ta yi aiki. Gwada suna da adireshi daban don kada gazawar biyu ta taɓa haɗuwa cikin rahoto ɗaya.

IPv6 yana buƙatar sasantansa a cikin ƙira. Fassarar IPv4 da ke aiki ba ta faɗi kome game da ko abokan cinikin IPv6 suna da hanya, tushen jama'a mai inganci ko manufar da ke toshe su idan ramin ya faɗi. Barin hakan ba a faɗe ba yana nufin rabin abokan ciniki suna ƙetare ƙofar cikin shiru yayin da sauran rabin ke aiki.

Don karɓa, bi buƙatar abokin ciniki ɗaya da aka yarda da ita da amsarta ta kan iyakoki biyu, kuma rubuta adireshin da kowane iyaka ya kamata ya gani a wannan lokacin. Wannan rikodin shi ne ke sa canjin tafki na gaba ya zama gyara na minti biyar maimakon jayayya kan wanda ya mallaki hanyar dawowa da ta ɓace. Ajiye rikodin tare da bayanin martabar abokin ciniki maimakon a cikin tikit, domin bayanin martabar shi ne abin da injiniya na gaba zai fara samu.