Abokin ciniki na OpenVPN yana isa uwar garke amma ba zuwa LAN hosts: jerin dubawa

Abokin ciniki ya ce an haɗa shi, adireshin ramin yana amsa ping, kuma babu wani abu a LAN na ofis da ke amsa. Ina ganin wannan bayan kusan kowane sabuntawar abokin ciniki, kuma tunanin farko shi ne buɗe wutar bango, wanda yawanci ba daidai ba ne: ramin yana lafiya, kuma karyewar tana ɗaya daga cikin tsalle uku da fakitin dole ya wuce. Bi hanyar a cikin tsarin da fakitin ke bi, farkon hanyar abokin ciniki, sannan turawar uwar garke, sannan tafiyar dawowa, kuma za ka sami mai laifin kuskuren cikin ’yan mintuna.

Mataki na farko: duba shawarar hanya ta abokin ciniki

Kafin ka taɓa uwar garke, tabbatar cewa abokin ciniki yana aika fakitin cikin ramin. Tambayi kernel wace fuska zai yi amfani da ita don wani LAN host, maimakon karanta dukkan teburin:

ip route get 192.168.50.10

Idan amsar ta ambaci adaftar jikinka da ƙofar ofis, babu wani canji a ɓangaren uwar garke da zai taimaka. OpenVPN yana ba da hanyoyi ne kawai lokacin da uwar garke ta tura su, don haka nemi push "route 192.168.50.0 255.255.255.0" a cikin saitin uwar garke, sannan ka sake haɗa abokin ciniki bayan haka. Yawancin abokan ciniki suna amfani da hanyoyin da aka tura lokacin haɗawa, ba lokacin da ka sake loda bayanin ba.

A Windows tambayar ɗaya tana da wata umarni. Find-NetRoute -RemoteIPAddress 192.168.50.10 yana buga fuskantar da tsalle na gaba da tarin zai zaɓa, kuma route print -4 yana nuna ko prefix ɗin da aka tura ya wanzu kwata-kwata.

Mataki na biyu: tabbatar uwar garke za ta tura fakitin

Idan hanyar abokin ciniki daidai ce, fakitin yana isa uwar garke kuma uwar garke dole ta yarda ta tura shi. Maɓallin kernel shine ƙofar farko, kuma sysctl net.ipv4.ip_forward dole ya dawo da 1. Saitawa da echo 1 > /proc/sys/net/ipv4/ip_forward yana aiki har zuwa sake yi na gaba, kuma wannan shine ainihin dalilin da korafin ɗaya ke dawowa bayan makonni.

Rubuta shi a wani wuri da zai tsira daga sake yi:

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-openvpn-forward.conf
sysctl --system

Ƙofar ta biyu ita ce teburin tacewa. Host ɗin da aka sa Docker a kai sau da yawa yana ɗauke da manufar FORWARD ta DROP, kuma ramin yana gado wannan shawarar. iptables -L FORWARD -v -n yana nuna manufar da lissafin fakiti duka; idan manufar DROP ce, turawa tana buƙatar izini bayyananne don alkiblar daga rami zuwa LAN da kuma ɗaya don amsa.

Mataki na uku: bi fakitin zuwa LAN ka nemi amsa

Duba ɓangarorin uwar garke biyu a lokaci ɗaya. Ka kama kan ramin da kan fuskantar LAN, an tace zuwa abokin ciniki ɗaya da host ɗaya domin fitarwar ta kasance mai sauƙin karantawa:

tcpdump -ni tun0 host 192.168.50.10
tcpdump -ni eth0 host 192.168.50.10

Buƙatun da suka bayyana a kan tun0 sannan kuma a kan eth0 da tushen 10.8.0.x, sannan shiru ya biyo baya, suna nufin fakitin ya iso kuma amsar ta tafi wani wuri. LAN host yana amsa wa ƙofar sa ta asali, wannan ƙofar ba ta da hanya don tafkin VPN, kuma amsar tana mutuwa a kan rawutar LAN. Yin ping ga LAN host daga uwar garke ba ya tabbatar da komai game da wannan hanya, domin wannan zirga-zirgar ba ta taɓa wucewa ta ramin ba.

Mataki na huɗu: zaɓi tsakanin fassara da hanyar dawowa

Gyare-gyare biyu suna rufe ramin, kuma zaɓin yana da sakamako fiye da ko ping yana aiki. Fassarar tushe tana mai da uwar garke a matsayin mai aikawa a bayyane:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Iyakance ƙa’idar zuwa tafkin da fuskantar LAN, sannan ka maida ta dindindin, in ba haka ba sake loda wutar bango na gaba zai cire gyaran ka a hankali. Farashin shine asali: kowane abokin ciniki yana kama da uwar garken VPN a cikin tarihin LAN da ƙa’idodin shiga, kuma per-client policy becomes guesswork.

Hanya ta tsaye don 10.8.0.0/24 a kan rawutar LAN, tana nuni ga uwar garken VPN, tana kiyaye adireshin abokan ciniki a bayyane kuma ita ce amsa mafi kyau na dogon lokaci idan wannan rawutar naka ce. Wurare da yawa suna gudanar da duka biyu na ɗan lokaci, NAT don gyaran gaggawa da kuma hanyar da zarar an rubuta manufar wutar bango. Idan uwar garke abokin haɗin yanki-da-yanki ne maimakon tafki, ɓangaren uwar garke kuma yana buƙatar iroute don ƙaramin cibiyar da ke nesa, in ba haka ba hanyar abokin haɗin tana nan amma zirga-zirgar abokan ciniki ba ta taɓa haɗawa da ita ba.

Mataki na biyar: tabbatar daga abokin ciniki ka rubuta abin da ya canza

Rufe zagayowar daga abokin ciniki, ba daga uwar garke ba. Haɗa zuwa wata sabis ta gaske a kan LAN host, sannan tabbatar cewa lissafin fassara sun motsa da iptables -t nat -L POSTROUTING -v -n, domin ƙa’idar da babu fakiti ita ce ƙa’idar da ba ta taɓa dacewa ba. conntrack -L -s 10.8.0.5 yana nuna kwarara da yanayinta lokacin da kake buƙatar hujja cewa alkiblar dawowa ana bibiya.

Bar bayani a cikin saitin uwar garke: wace ƙaramin cibiya, wace fuska, wace ƙa’ida, da ko rawutar LAN tana ɗauke da hanyar dawowa. Lokaci na gaba da sabuntawar abokin ciniki ta goge hanyar da aka tura, wannan bayanin yana mai da zaman kashe wuta gyaran layi ɗaya.