Na’ura ɗaya ta hanyar VPN na rawuta tana bukatar ƙa’idoji uku, ba maɓalli ba

A cikin VPN na rawuta babu maɓalli na kowace na’ura; maɓallin da kake nema gajeruwar hanya ce da ke rubuta ƙa’idojin tafarkin siyasa a madadinka. A lokacin da kwamfutar hannu ɗaya, kewayon tashar ruwa ɗaya, jerin adireshi ɗaya ko ɓangaren LAN ɗaya ya kamata ya yi amfani da rami yayin da sauran duka ke zama a WAN, kana gina tafarki na siyasa ne ba kunna fasali ba. Aikin yana da sassa uku masu motsi, kowanne yana kasawa daban: tebur mai alama ba tare da tafarki ba yana kama da shiru, alamar da aka sanya a sarkar da ba daidai ba tana kama da babu abin da ya faru, kuma ƙa’idar NAT da ta ɓace tana kama da rami da ke haɗawa kuma ba ya ɗauka kome. Ƙarin sassa biyu sun ɓace domin ba sa fitowa a ƙa’idar mangle, kuma su ne DNS da IPv6.

Tatsuniya: ramin saitin abokin ciniki ne

Abokin ciniki na VPN a gefen rawuta yana yin abu ɗaya mara hankali da kyau: yana sanya 0.0.0.0/0 a cikin babban teburin tafarki kuma yana nuna shi zuwa ramin. WireGuard yana samun haka daga AllowedIPs, OpenVPN daga redirect-gateway da aka tura, kuma dukansu suna canza hanyar kowace mai masauki a bayan rawuta. Ƙunƙwasa AllowedIPs ko ƙara route-nopull yana canza abin da abokin ciniki ke girka. Ba ya canza wanda girkin ya shafa, domin abokin ciniki ba ya ganin na’urori. Yana ganin fakiti ne kawai.

Zaɓi bisa tushe ko manufa yanke shawara ce ta tafarki, don haka tana cikin matakin siyasa na rawuta: ƙa’idar mangle da ƙarin tebur na biyu a RouterOS, MARK da ip rule a OpenWrt ko DD-WRT, ko ƙa’idar katangar wuta wadda ƙofarta ita ce ramin a pfSense. Littafin abokin ciniki na WireGuard na Netgate shi ne abin da ya kamata a karanta kafin yin hasashe, domin a wannan dandali ƙofar ƙa’idar, rabon mu’amala da shigarwar NAT mai fita duk dole su daidaita kafin abokin ciniki ɗaya ya yi amfani da ramin.

Rabin tatsuniyar na biyu shine rawuta ta biyu. Sayen wata akwati ko matsar da na’urar zuwa SSID na baƙi yakan yi aiki, kuma dalilin ba kayan aiki bane: yana sanya na’urar a kan nata ƙananan cibiyar sadarwa, wanda ke ba ka zaɓin tushe da firmware ya riga ya fahimta. Idan za ka iya bayyana wannan ɓangaren a kan rawutar da kake da ita, ƙarin akwatin yana magance matsalar da ba ka da ita.

Sashe na ɗaya: rami wanda ba tafarkin asali ba

A RouterOS, ƙara abokin ciniki ba tare da tafarkin asali ba kuma ba da ramin nasa tebur. Tafarkin farko shine alamar asali; na biyu shine rabin gazawa.

/ip route add dst-address=0.0.0.0/0 gateway=VPN_GATEWAY_IP routing-mark=vpn distance=1
/ip route add dst-address=0.0.0.0/0 type=unreachable routing-mark=vpn distance=2

Tafarkin unreachable shine dalilin da yasa tebur mai alama ke cin jerin keɓancewa a babban tebur. Lokacin da ramin ya faɗi, fakiti masu alama suna samun unreachable nan take maimakon komawa WAN a hankali, don haka gazawar tana bayyana a saƙon kuskure na manhaja ba a shafin wuri na yanayi da kake dubawa bayan awa ɗaya ba.

RouterOS 7 yana raba abin da 6.x ya riƙe tare: kana bayyana tebur da /routing table add name=vpn fib, sannan ka yi masa nuni da suna a tafarki da kuma a ƙa’idar mangle. Guntun 6.x da ke sanya routing-mark a layi ba tare da bayyana tebur ba yana lodawa da tsabta kuma ba ya dacewa da kome. Wani sanannen yanayi shine rabin 0.0.0.0/1 biyu, ko tafarkin asali biyu a nesa ɗaya a tebur ɗaya: kernel yana zaɓar ɗaya, kuma halin na iya canzawa bayan sake kunnawa.

Sashe na biyu: yi alama kafin binciken tafarki

Zaɓi yana yanke shawara wace fakiti za su shiga wannan tebur. RouterOS yawanci yana farawa da jerin adireshi don siyasar manufa, ko adireshin tushe don siyasar na’ura:

/ip firewall mangle add chain=prerouting src-address=192.168.88.50 action=mark-routing new-routing-mark=vpn
/ip firewall mangle add chain=prerouting dst-address-list=via-vpn action=mark-routing new-routing-mark=vpn
/ip firewall address-list add list=via-vpn address=203.0.113.10

Firmware na Linux yana yin haka da alamar netfilter da ƙa’idar da ke tura fakiti masu alama cikin tebur da ka cika:

iptables -t mangle -A PREROUTING -p tcp --dport 27000:27050 -j MARK --set-mark 0x200
ip route add default dev tun0 table 100
ip rule add fwmark 0x200 table 100

Sarkar ba zaɓin salo ba ce. Lokacin da fakiti ya isa FORWARD, an riga an yi binciken tafarki, don haka MARK ko DROP a can zai iya sake rubutu ko watsi kawai. Alamar dole ta faɗi a PREROUTING don zirga-zirgar da ake turawa da kuma a OUTPUT don zirga-zirgar da rawutar kanta ke ƙirƙira, domin a nan ne DNS, NTP da duba sabuntawa na rawuta suke zaune. Wannan hanyar fita ita ce sanannen dalilin da yasa saitin da aka yi masa rami gaba ɗaya har yanzu yana amsa daga mai warwarewar ISP a gwajin ɓoyewa.

Siyasar na’ura tana bukatar daidaito wadda ba ta motsawa. Ajiye adireshin a DHCP, ko daidaita mu’amala don wani ɓangare na musamman; adireshin da daga baya ya koma wata na’ura yana sanya ramin a hankali ga abokin ciniki mara kyau. Gada ga kowace SSID da nata ƙananan cibiyar sadarwa ita ce sigar da ta fi dorewa na wannan tunani, kuma tana ba ƙa’idojin IPv6 wurin zama.

Sashe na uku: NAT, DNS da keɓancewar LAN

Zirga-zirgar da ke fita ta ramin tana bukatar adireshin tushe wanda gefen nesa zai amsa. Iyakance fassarar ga mu’amalar ramin: out-interface=VPN_NAME a RouterOS, -o tun0 a Linux, shigarwar NAT mai fita mai dacewa a pfSense. Ƙa’idar masquerade ba tare da wannan iyaka ba tana sake rubuta zirga-zirgar da ka yi niyyar barin ta haka, kuma alamar ita ce na’urar da ba a yi mata rami ba ta rasa adireshinta na jama’a.

Keɓancewar LAN tana haifar da zaren tallafi fiye da ramin kansa. Idan tebur mai alama yana ɗauke da tafarkin asali kawai, manufar firinta ko NAS daga na’urar da aka zaɓa tana dacewa da wannan asalin kuma tana ɓacewa cikin ramin. Ƙara tafarkin LAN cikin wannan tebur, ko cire ƙananan cibiyar sadarwar gida a cikin zaɓi; dukansu suna aiki, kuma keɓancewar tana da sauƙin riƙewa daidai idan ka ƙara VLAN daga baya.

DNS yana ɗaukar wata hanya dabam. Tambayoyin da rawuta ke turawa suna fitowa daga rawuta kuma suna bin OUTPUT, ba alamar turawa ba, don haka kwamfutar hannu da aka yi mata rami gaba ɗaya tana iya warwarewa ta ISP har yanzu. Nuna abokan ciniki zuwa mai warwarewa da ake iya samu ta ramin, ko yi alama ga zirga-zirgar tashar 53 ta rawutar kanta, sannan duba adireshin da aka warware maimakon ɗauka cewa amsar ta yi tafiya tare da buƙatar yanar gizo.

Lokacin da ƙa’idar ta dace amma manhajar har yanzu tana amfani da WAN

Jerin manufofi suna tsufa da kyau ba. Suna yana warwarewa zuwa adireshin da ba ya cikin jerin, don haka buƙatar tana ɗaukar WAN yayin da duk gwajin da ka yi a kan adireshin da ke cikin jerin ya yi aiki. Sabunta jerin daga mai warwarewar da abokin ciniki ke amfani da shi, kuma fifita zaɓi bisa tushe idan da gaske kake son duk zirga-zirgar na’ura ɗaya.

IPv6 ita ce hanya ta ɓoye a shiru. Na’urar tana da wani rukunin adireshi na biyu da nasa tafarkin asali da nata tsarin ƙa’idoji, kuma daidaita adireshin IPv4 kawai rabin siyasa ne. Yi amfani da wannan zaɓi a kan ip6tables ko makamancin nftables, ko kashe IPv6 a wannan ɓangaren da gangan ba da haɗari ba.

Haɗin da aka kafa ma suna da muhimmanci. Shigarwar conntrack da aka ƙirƙira kafin canjin tana bin tsohon tafarki har sai ta ƙare, don haka burauza da ya kasance a buɗe yayin gyaran yana kama da ƙa’idar da ba a taɓa amfani da ita ba. Buɗe sabon haɗi, ko wanke yanayin, kafin ka yi hukunci kan siyasar.

Tabbatar da na’urori biyu da sake kunnawa

Gwada na’urar da ya kamata ta kasance cikin ramin da wadda ba ta kamata ba, kuma kwatanta tsalle na biyu maimakon lambar sauri. Traceroute daga kowace tana nuna ko dai ƙofar ramin ko ƙofar ISP a tsalle na biyu; idan dukansu sun yi kama ɗaya, alamar ko tebur ɗin ba ya yin abin da ƙa’idar ta ce. Yi amfani da sabbin haɗi don gwajin.

Sannan sake kunna. Tsarin farawa shine inda siyasar da ke aiki ta zama karyayyiya, domin abokin ciniki dole ya kasance a kunne kafin a girka tafarkin unreachable, kuma hoton da aka adana wanda ke maido da tsohon tsarin ƙa’idoji zai rubuta a kan teburinka. Tabbatar kowace ƙa’ida tana cikin saitin da aka adana kuma alamar asali tana wanzuwa bayan boot, ba kawai bayan ka rubuta ta ba.

Idan wani abu ya kasa, cire alamar tukuna ka ga ko zirga-zirgar al’ada ta dawo, sannan cire tebur. Wannan tsari yana gaya maka ko kana bin matsalar tafarki ko matsalar katangar wuta, kuma yana barin gida da firinta mai aiki yayin da kake kammala aikin.