Yadda abokin ciniki na OpenVPN bayan NAT ke zama hanyar fita ta intanet

Raguna uku na Linux, ƙira ɗaya: cibiyar OpenVPN da ake iya samu a bainar jama'a, kwamfutar ɗimau na mabukaci da na'urar fitowa a bayan na'urar sadarwar gida ta yau da kullum wadda ba ta tura komai zuwa ciki. Fitowar da kanta tana buga waya zuwa cibiyar. Sannan zirga-zirgar intanet na mabukaci tana shiga ramin a kwamfutar ɗimau kuma tana fita ta hanyar haɗin sama na fitowar kanta. Duk abin mamaki a wannan tsari ya biyo daga bayani ɗaya: fitowar ce ta fara haɗin, don haka hanyar shiga ta riga ta wanzu kuma ba a bukatar tura tasha don ƙirƙirar ta.

Abin da ke biyo yana bin hanyar fakiti maimakon tsarin daidaitawa, domin daidaitawar tana da ma'ana ne kawai idan ka san wane ɓangare ke ɗaukar wace shawara. Kowace matakin tana ɗaukar shawara ɗaya daidai, kuma kurakurai suna taruwa inda ake ɗaukar matakai biyu a matsayin ɗaya.

Zaman motsi biyu, hanya ɗaya ta ciki

Kowane mai masauki yana riƙe da haɗinsa na waje zuwa cibiyar, kuma babu ɗaya daga cikin waɗannan haɗin da ya san ɗayan. Zirga-zirgar mabukaci zuwa intanet wani kwarara ne na ciki daban wanda ya faru ana ɗaukarsa cikin ramin mabukaci sannan a sake fitar da shi daga ramin fitowar. Wannan kwararar ta ciki ce cibiyar za ta ba da hanya, kuma ita ce fitowar za ta tura gaba.

outer: consumer --TLS--> hub
outer: exit     --TLS--> hub
inner: consumer --tun--> hub --internal--> exit --tun--> uplink

Domin duka haɗin waje biyu suna fita daga gefen abokin ciniki, na'urar sadarwar fitowar ba ta taɓa ganin SYN mai shigowa ba kuma ba ta taɓa bukatar ka'idar NAT ta manufa ba. Sai dai ta riƙe jigilar da aka kafa a raye, abin da ta riga ta yi ga kowane haɗi mai tsawo. Babu wani abu a intanet na jama'a da ke bukatar isa fitowar da farko, shi ya sa adireshin mai canzawa a wannan haɗin sama ba matsala ba ne. Na'urar sadarwar har yanzu dole ta ba da izinin zaman fita, amma wannan ita ce izinin da mai bincike ke amfani da shi.

Abin da iroute ke girka a cikin uwar garke

Cibiyar ita ce kawai na'urar da ke yanke shawarar wane abokin tarayya ya mallaki wace manufa, kuma tana yanke wannan shawarar a cikin teburin hanyarta na sararin mai amfani, ba na kernel ba. Shigar client-config-dir na fitowar mai suna exit-node na iya neman fifikon tsoho a can:

# /etc/openvpn/server/ccd/exit-node
iroute 0.0.0.0 0.0.0.0

Wannan layin yana gaya wa aikin uwar garke "fakitin ciki da kowace manufa na wannan abokin ciniki ne". Ba ya ƙara tsohuwar hanya ga tsarin aiki na cibiyar kuma ba ya mai da cibiyar ƙofar intanet. Bayanin OpenVPN 2.6 yana riƙe da hanyar ciki ta musamman ga abokin ciniki da hanyar kernel a matsayin hanyoyi daban, kuma wannan rabuwa ita ce dalilin da ya sa wannan ƙira ke aiki ba tare da taɓa tsohuwar hanyar cibiyar ba.

Mabukaci yana bukatar umarnin madubi, wanda aka kawo a matsayin push, domin zirga-zirgarsa ta shiga ramin maimakon fita ta ƙofarsa ta gida. Da tsarin ƙananan hanyar sadarwa, tafkin hanya ce da aka haɗa a na'urar tun ta fitowar, don haka alkiblar dawowa ba ta bukatar ƙarin push; abin da fitowar ba za ta karɓa ba shi ne juyar da ke ƙasa, wanda zai mayar da zirga-zirgar haɗinta na sama cikin ramin da take ƙoƙarin amfani da shi. Aika shi ga mabukaci kawai, kuma karanta hanyoyin da aka yi amfani da su a abokin ciniki maimakon dogaro da an zaɓi fayil ɗin CCD.

# /etc/openvpn/server/ccd/consumer-01
push "redirect-gateway def1"

Kernel na fitowar ne ke yin turawa gaba

A cikin fitowar, fakiti daga mabukaci yana isowa a fuskar tun da aka yi wa wani mai masaukin intanet adireshi. Kernel yana duba teburin hanyarsa, ya sami haɗin sama na gaske a matsayin mafi kyawun daidaituwa sannan ya yi amfani da manufofi biyu masu zaman kansu: shin ana iya tura wannan fakiti gaba kwata-kwata, kuma shin zai iya fita ta wannan fuskar da wannan adireshin tushe. Turawa gaba sysctl ne, kuma a yawancin rarraba yana kashewa ta tsohuwa.

Don haka fitowar tana bukatar turawa gaba ta IPv4 da aka kunna ta dindindin, ka'idar turawa gaba da ke karɓar tushen ramin mabukaci zuwa haɗin sama, da hanyar amsa ta komawa ta tun. Kunna turawa gaba ga dukan mai masauki yana canza halin duk wani abu da ke bi ta hanyarsa, shi ya sa ka'idar ya kamata ta ambaci tushe da fuskoki maimakon karɓar komai.

Fassarar tushe ce ke sayen hanyar dawowa

Mai masaukin intanet ba shi da hanya zuwa adireshin 10.90.0.x, don haka za a jefar da amsoshi kafin su isa fitowar. Sake rubuta tushen yayin da fakitin ke barin haɗin sama yana magance hakan, kuma bin diddigin haɗi yana juya sake rubutun a hanyar dawowa.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.90.0.0/24 -o enp1s0 -j MASQUERADE
ip -4 route get 10.90.0.9   # run on the exit: must point at the tun

Ka'idar da ke sama mafari ne ga fuskar haɗin sama ɗaya, ba manufar katangar wuta ba. Ƙuntata tushen zuwa ayyukan da ka ba da izini da gaske, kuma ka riƙe manufar shigar fitowar daban domin rufewa don zirga-zirgar rami ba ya fallasa ayyukan gida a hankali. A kan mai masauki mai adireshin haɗin sama mai canzawa, rufewa yana kuma kuɓutar da kai daga bin adireshin da hannu.

Inda cibiyar za ta iya aiwatarwa da inda ba za ta iya ba

Da client-to-client da hanyar bayanan sararin mai amfani ta gargajiya, cibiyar tana ba da fakitin ciki tsakanin abokan tarayya a cikin aikin uwar garke. Ba sa taɓa ratsa sarkar FORWARD ta kernel na cibiyar, don haka ka'idar kernel a can ba za ta iya hana wucewa tsakanin abokan tarayya ba, duk yadda aka rubuta ta da kulawa. Dole aiwatarwa ta kasance a cikin manufar uwar garke kanta: wanda aka ba izinin haɗawa, wane fayil ɗin CCD yake samu, da ko ana ba da mallakar fitowar ta tsohuwa kwata-kwata.

Shi ya sa tsohuwar iroute babbar shawara ce ta amana. Fitowar dole ta karɓi zirga-zirgar dawowa daga adireshin intanet na son rai bisa doka, kuma dole ta kasance na'urar da kake sarrafawa, gyarawa da sa ido. Ba da wannan mallaka ga abokin tarayya da ba za ka ba da na'urar sadarwa ba ita ce kuskuren da wannan ƙira ke kira zuwa gare shi.

Kasancewa memba ita ce ainihin sarrafawa. Duk abokin ciniki da zai iya daidaita hanyoyinsa na iya ƙoƙarin amfani da fitowar, don haka ƙuntata wanda za a iya haɗawa, ko waɗanne abokan tarayya fitowar za ta yi wa hidima, ɓangare ne na ƙirar ba tunani na baya ba.

Rashin lalacewa yayin da fitowar ta ɓace

Kashe fitowar kuma mallakar cikin ta tsohuwa tana ɓacewa tare da zamanta. Abin da bai kamata ya faru ba shi ne cibiyar ta zama maye gurbin fitowar a hankali: babu tsohuwar hanya daga tafkin VPN zuwa haɗin sama na cibiyar, kuma babu faɗin ka'idar rufewa a kan cibiyar da za ta tura wannan zirga-zirgar da daɗi. Gwada wannan gazawar da gangan, sannan gwada farfadowa da sabon kwarara maimakon shafi da ya riga ya buɗe.

# on the consumer, with the exit up and then down
ip -4 route get 1.1.1.1
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com

Idan zirga-zirgar mabukaci har yanzu yana isa intanet bayan fitowar ta tafi, wani abu ne ke ɗaukarsa kuma iyakar da ka yi niyya ba ta wanzu. Kula da DNS da IPv6 a matsayin shawarwari daban: hanyar IPv4 da rufewa ba su ce komai game da zirga-zirgar AAAA ba, kuma mai warwarewar da cibiyar ta tura zai amsa daga inda tambayar ta fito da gaske.