Katsewar shiga LAN ta OpenVPN? Duba yankuna, hanyoyi da hanyar dawowa

Tunnel ɗin yana ba da rahoton nasarar haɗi, shafin router ɗin kansa yana lodawa, amma haɗin faifai zuwa na'urar da ke bayansa har yanzu yana ƙarewa. Babu wani abu mai cin karo a cikin wannan haɗin: router ɗin yana amsawa a matsayinsa, kuma isa ga wani abu a bayansa wata shawara ce daban da ake yi a wani wuri. Yi gwaje-gwajen da ke ƙasa bisa tsari ka tsaya a gazawar farko, domin kowanne ya dogara ne a kan wanda ya gabata. Idan duka huɗun sun wuce, laifin yana sama da tunnel ɗin ba a cikinsa ba.

Wane tacewa ne ke ganin fakitin da ke zuwa LAN

Fakitin da aka aika zuwa router ɗin ana cinye shi a cikin gida; fakitin da aka aika zuwa ga mai masaukin da ke bayansa dole a tura shi, kuma bangon wuta yana yanke hukunci a kan waɗannan al'amura biyu daban. Don haka izinin isa ga router ɗin ba ya faɗin komai game da izinin ratsa shi. Firmware da ke ɓoye jerin ƙa'idodinsa har yanzu yana aiwatar da duka biyun, yawanci a matsayin mai zaɓi wanda ke bayar da LAN, intanet ko duka biyun. Idan mai zaɓin ya bar LAN, babu wani gwaji na gaba da zai yi amfani.

OpenWrt yana sa wannan rabuwa a iya dubawa, kuma bambancin ya cancanci karatu ɗaya. Yankin da ke ƙare tunnel ɗin yana buƙatar ƙa'idar turawa zuwa yankin LAN, yayin da ƙa'idar shiga ke sarrafa ayyukan da ke gudana a kan router ɗin kansa kawai. Shafin gudanarwa mai aiki kusa da mataccen LAN shine sakamakon da aka saba na wannan ƙa'idar turawa da ta ɓace.

uci show firewall | grep -E "zone\[[0-9]+\]\.(name|input|forward|output)"

Duba makasudin turawa na yankin da ke ɗauke da tunnel ɗin: accept shine abin da tsani ke buƙata, kuma reject yana bayanin kowane ƙarewar lokaci da ke ƙasa. Saiti biyu na kusa suna haifar da wannan alama, don haka cire su yayin da kake nan. Keɓewar mara waya tana ɓoye masu masaukin waya daga abokan ciniki marasa waya, kuma router ɗin da ke ɗaukar marasa aiki a LAN a matsayin ba su kan layi ba zai iya jefar da amsoshin ko da bayan turawa ta yi aiki.

Me ya sa rarrabuwar tunnel ke buƙatar prefix ɗin da aka tura

Abokin cinikin da ke aika duk zirga-zirga ta tunnel ɗin yana riga yana da prefix ɗin LAN ta hanyar tafiyarsa ta asali, don haka babu abin da za a ƙara. Rarrabuwar tunnel ita ce yanayin da ke buƙatar bayyana prefix ɗin a fili, domin babu wani abu a cikin saitin da ke ambatonsa. Ƙara umarnin zuwa saitin uwar garke sannan ka sake loda sabis ɗin.

push "route 192.168.50.0 255.255.255.0"

Bayanan da suka ƙunshi route-nopull suna watsi da hanyoyin da aka tura, don haka wannan prefix ɗin ya kamata ya kasance a cikin fayil ɗin abokin ciniki maimakon. Ko ta yaya, tabbatar da shigarwar ta iso maimakon ɗauka haka, domin maye gurbin shiru yana kama da matsalar bangon wuta.

ip route show | grep 192.168.50

Abokin haɗin yanar gizo-zuwa-yanar gizo yana buƙatar fiye da turawa. Dole uwar garke ta koyi waɗanne prefixes ne ke bayan wannan abokin, wanda layin iroute a cikin fayil ɗinsa na client-config-dir ke yi, kuma teburinsa yana buƙatar hanyar da ta dace zuwa cikin tunnel ɗin.

Amsar tana buƙatar adireshin da za ta iya isa

Tura buƙatar rabin musayar ne kawai, domin mai masaukin LAN dole ya amsa adireshin da ke cikin tafkin tunnel ɗin. Ƙananan routers yawanci suna shirya hakan ta hanyar fassara tushen a yankin tunnel ɗin, don haka amsar tana zuwa ga router ɗin kuma ba ta buƙatar saiti a wani wuri. Cire wannan fassarar kuma mai masaukin zai buƙaci tafiyarsa zuwa tafkin, wadda yake samu kyauta idan router ɗin shine ƙofarsa ta asali. Mai masaukin da ke da adireshin da aka saita da hannu da wata ƙofa daban yana amsawa ta wannan ƙofar, kuma abokin ciniki yana ganin zama yana buɗewa sannan ya tsaya.

tcpdump -ni tun0 host 192.168.50.20

Gudanar da hakan a kan router ɗin yayin da abokin ciniki ke maimaita buƙatarsa, kuma karanta inda amsar ta nufa ba buƙatar kanta ba. Amsar da ta nufi tafkin tana nufin hanyar dawowa tana aiki kuma laifin yana can ciki. Rashin amsa kwata-kwata yana nufin mai masaukin bai taɓa karɓar fakitin ba, wanda ke mayar da kai ga jerin ƙa'idodi.

Tsani da ke ƙarewa a wurin da ya dace

Gwaje-gwaje huɗu suna gano matakin, kuma kowanne umarni ɗaya ne ba hukunci ba. Gudanar da su bisa tsari ka tsaya a gazawar farko. Tsari ya fi umarnin muhimmanci, domin matakin da ya wuce daga baya yana ɓoye dalilin da ya sa na baya ya gaza.

ping -c1 10.8.0.1
ping -c1 192.168.50.20
nc -vz 192.168.50.20 445
getent hosts nas.local

Sunaye suna cikin ƙarshen tsanin, ba a farkonsa ba. Rabon da ke amsawa a matsayin 192.168.50.20 amma ba a matsayin nas.local yana nuna warware suna ko ƙarin bincike, kuma gyare-gyaren bangon wuta ba za su iya canza ɗaya daga cikinsu ba.

Rubuta matakin farko da ya gaza, sannan ba tashoshin sabis nasu zagayen, domin mai sauraro da izinin mai masauki buƙatu ne daban. Rabon fayiloli, tebur na nesa da watsa kyamara duk suna buƙatar duka biyun, kuma bangon wutar mai masaukin da ke amincewa da ƙaramin cibiyar LAN amma ba tafkin tunnel ba yana watsar da abokin ciniki yayin da ping ke ci gaba da yin nasara. Idan duk gwaje-gwajen sun wuce kuma manhajar har yanzu tana gaza, laifin yana sama da tunnel ɗin: sabis da aka ɗaure ga mahada ɗaya, ko wakili da aka saita a kan abokin ciniki.