Babu maɓalli don ware wannan manhaja: ba wa tsari nasa tushen

Ya kamata shiri ɗaya ya yi amfani da haɗin da aka saba yayin da duk sauran su kasance a cikin rami, kuma abokin ciniki ba shi da maɓalli don hakan. Babu wani ɓoyayyen menu da za a same shi. Ana zaɓar hanya daga filaye a cikin fakitin, kuma fakitin yana ɗauke da adireshi da tashoshi maimakon ainihin tsarin da ya ƙirƙira shi, don haka dole a bayyana warewa a ɗaya daga waɗannan filayen. Bi fakitin sau ɗaya kuma zaɓuɓɓukan da ke akwai sun daina zama abin mamaki.

Me ya sa abokin ciniki ba zai iya bayar da shi ba

Tafarkin hanya na manufa yana kwatanta adireshin manufa da prefixes kuma yana riƙe mafi tsayin daidaito. A wannan lokacin kowane fakitin ya yi kama da ɗaya, ko me ya samar da shi. Tafarkin hanya bisa manufar tushe yana faɗaɗa kwatancen zuwa adireshin tushe, kuma wannan shine ƙugiya da kowace mafita mai amfani take amfani da ita: canza tushen, sai wani tebur ya zama cancanta.

Tashoshi ba su taimaka. Warewa bisa tasha dole a auna shi kafin binciken manufa, kuma tashar ba ta da wani bangare a wannan shawarar. Duk abin da aka tallata a matsayin warewa bisa tasha yana warewa da wani fili ne kawai kuma yana kwatanta shi a hankali.

Ainihin tafarkin hanya bisa manhaja yana wanzu inda dandamali ya ƙara injina don shi, kamar kiran tacewa a Windows ko ɗaure sabis ɗin VPN a Android. Kwafin OpenVPN na kwamfutar tebur ba ya kawo ko ɗaya daga cikin waɗannan, kuma babu tutar saiti da zai ƙirƙira shi.

Linux: yi wa tsari alama, sannan ka bi diddigin alamar

Mafi tsaftataccen hanya yana danganta shawarar ga tsarin da ya mallaki soket ɗin. Daidaiton owner yana aiki ga zirga-zirgar da aka samar a gida a cikin sarkar OUTPUT, don haka alamar da aka yi amfani da ita a can na iya zaɓar wani tebur daban:

iptables -t mangle -A OUTPUT -m owner --uid-owner 1001 -j MARK --set-mark 0x1
ip rule add fwmark 0x1 table 200
ip route add 192.168.1.0/24 dev eth0 src 192.168.1.0 table 200
ip route add default via 192.168.1.1 dev eth0 table 200

Fakitin mai amfani 1001 sai su tuntuɓi tebur 200 kuma su fita ta hanyar ƙofar da aka saba, yayin da babban tebur ke ci gaba da aika duk sauran cikin rami. Daidaiton owner yana aiki ne kawai ga fakitin da aka samar a gida, wanda shine ainihin zirga-zirgar da ke da muhimmanci a nan, kuma ba zai iya rarraba fakitin da aka tura wa wani mai masauki ba. Tabbatar da kayan aiki ba da niyya ba: ss -tnp yana nuna adireshin gida da tsarin da ya mallaki haɗin da aka kafa, kuma ip route get 1.1.1.1 mark 0x1 yana nuna wane tebur alamar take zaɓa.

Wurin sunan cibiyar sadarwa shine amsa mafi ƙarfi ga shiri mai zaman kansa, domin kowane soket da aka ƙirƙira a cikinsa yana da alaƙa da shi ta hanyar gini, don haka tsarin taimako da haɗin yara suna gado halin ba tare da an rarraba su kwata-kwata ba. Kuɗin shine aikin famfo: nau’in veth, adireshi a kowane ƙarshen, da tafarkin da aka saba a cikin sunan wurin da ke nuni zuwa ga mai masauki.

ip netns add novpn
ip link add veth-host type veth peer name veth-ns
ip link set veth-ns netns novpn
ip addr add 10.200.0.1/24 dev veth-host
ip netns exec novpn ip addr add 10.200.0.2/24 dev veth-ns
ip netns exec novpn ip route add default via 10.200.0.1

Windows: manufar har yanzu ita ce ke yankewa

Windows yana zaɓar Interface mai fita daga manufa, don haka shirin da ke son wata hanya dole ya canza wani abu da stack ɗin ke tuntuɓa kafin wannan zaɓi. ForceBindIP yana rufe rabin farko: yana fara shiri da soket ɗinsa riga an ɗaure su ga adireshin gida da ka ambata. Wannan shi kaɗai ba ya canza wace Interface fakitin ke fita ta gare ta, domin manufar har yanzu ita ce ke zaɓar tafarkin. Ɗaure tushe a kan kwamfutar hannu wadda tafarkinta na yau da kullum ke nuni cikin rami, kuma fakitin zai shiga ramin duk da haka.

Alamar tana da siffa mai iya karantawa da zarar ka san ta. Tana aiki ga adireshin LAN da Interface ɗin da aka zaɓa ke kaiwa kai tsaye kuma tana kasawa ga duk abin da ke intanet wanda tafarkinsa ke nuni ga rami. Har ila yau tana kama da tana aiki har sai shirin ya ba da aiki ga mataimaki, domin mataimakin da ya buɗe nasa soket ba a taɓa gaya masa game da ɗaurin ba.

Matsa shawarar lokacin da tsari ɗaya ba shi ne ma’aunin da ya dace ba

Idan ainihin buƙata na’ura ce ba shiri ba, saka ta a kan nata SSID ko VLAN kuma bari na’urar hanya ta yanke shawara: wannan tushen yana ɗaukar hanya ta al’ada yayin da sauran tushen ke amfani da ramin. Na’urar ƙofa da aka keɓe ita ce wata ƙirar gaskiya: tana riƙe da VPN kuma tana karɓar manufofin da na’urar hanya ke aika mata kawai. A kan VLAN manufar tana rufe kowane kwarara da na’urar ke buɗewa, har da tsarin taimako da suka karya hanyar Windows. Musayar ita ce iyaka: shirye-shirye biyu a kan wannan na’urar ba za a iya bi da su daban ba kuma.

Dukansu manufofin tushe ne ko na manufa tare da iyakar da za ka iya faɗa a jumla ɗaya. Babu ɗayansu bisa manhaja, kuma ƙirar da ke tallata kanta a matsayin bisa manhaja tana kasawa a karon farko da shirin ya ba da aikinsa ga wani tsari na biyu.