Handshake na PiVPN yana aiki, shafuka suna tsayawa: duba MASQUERADE

Wayarka tana nuna tunnel ɗin a matsayin haɗe, client ɗin yana bayar da adireshin sirri, kuma shafin farko har yanzu yana rataye a tsakiyar lodawa. Wannan haɗin yana tura yawancin mutane zuwa saitunan cipher da zafin CPU, inda babu wani abu da ya lalace a zahiri. Tunnel ɗin ya tashi, don haka tattaunawar ta ƙare; abin da ya kasa shine mataki na gaba, lokacin da uwar garken ke ƙoƙarin mika packets ɗin client ɗin zuwa intanet. Bi hanyar da waɗannan packets ɗin suke bi, kuma rashin daidaituwa yawanci ana iya gani a layi ɗaya na teburin NAT.

Fara daga abin da client ɗin zai iya kaiwa da abin da ba zai iya ba

Daga client ɗin da ke haɗe, loda shafin da ke zaune a intanet ɗin jama'a kuma lura ko yana kasawa nan take ko yana tsayawa a tsakiya. Sannan buɗe wata hanya a adireshin sirri na uwar garken VPN ɗin kansa kuma kwatanta sakamakon biyu.

Adireshin tunnel da ke amsa ping yayin da shafukan jama'a ke ƙarewa lokaci shine alamar matsalar turawa ko fassara, ba handshake ɗin da ya karye ba. Panel ɗin yanayi na client ɗin kansa ba zai iya bambanta su ba, domin ya san kawai cewa tashar sarrafawa tana sama. Duba interface ɗin tunnel a uwar garken da ip -br addr show tun0 kuma tabbatar da cewa adireshin da aka ba client ɗin yana cikin wurin ajiyar da ka saita. Idan wurin ajiyar da adireshin client ɗin ba su dace ba, gyara hakan da farko, domin kowace doka da ke ƙasa tana dacewa da wurin ajiyar.

Na gaba, tambayi uwar garken wace interface zai yi amfani da ita don isa adireshin jama'a. ip route get 203.0.113.9 yana buga na'urar da aka zaɓa da tushe a layinsa na farko. Rubuta sunan na'urar, domin shine ƙimar da dokar NAT dole ta ƙunshi.

Karanta dokar da ke yanke shawara ko packets ɗin za su fita

MASQUERADE yana sake rubuta packet ne kawai lokacin da packet ɗin ya fita ta interface ɗin da aka ambata a dokar. Dokar da aka iyakance ga na'urar waya ba ta yin komai ga zirga-zirgar da ke fita ta Wi-Fi, kuma packet ɗin yana riƙe adireshin tushensa na sirri har zuwa babbar rawuta. Wannan rawutar ba ta da hanyar komawa zuwa wurin ajiyar tunnel ɗinka, don haka tana watsar da amsar, kuma client ɗin yana ganin haɗin da ke buɗewa sannan ya mutu. Alamar tana ƙaruwa da yawan shafin da ke isowa kafin a buƙaci amsa ta farko.

Jeranta teburin mai rai kuma karanta ginshiƙin interface ɗin fita maimakon kawai neman kalmar MASQUERADE. Fitar da siffar ƙarawa ta fi sauƙin kwatantawa fiye da jeri da aka tsara:

ip -br addr show tun0
ip route get 203.0.113.9
sudo iptables -t nat -S POSTROUTING

A kan Raspberry Pi da ya taɓa amfani da Ethernet kuma yanzu yana amfani da Wi-Fi, tsohon sunan kusan koyaushe shine dukan labarin. Mai sakawa ya rubuta wace na'ura ce a lokacin saitin, kuma tarin dokar da aka adana yana sake kunna ta a kowace tashin. Kwatanta na'urar daga binciken hanya da wadda ke cikin dokar kafin ka canza wani abu. Idan sun dace, interface ɗin ba matsalarka ba ce kuma ya kamata ka koma ga ƙididdiga a sashin ƙarshe. Idan sun bambanta, gyaran shine gyaran kalma ɗaya a cikin fayil ɗin dorewa.

Gyara tarin dokar da aka adana, ba kawai wanda ke gudana ba

Gyaran teburin mai rai kawai yana jimrewa har zuwa sake tashi na gaba, wanda shine daidai tsawon da zai shawo kan ka cewa an warware matsalar. Dokokin da ke dawowa a tashin suna zaune a cikin fayil da fakitin dorewar wutar bango ke sake lodawa. A cikin hotunan Pi da suka dogara da Debian wannan fayil ɗin yawanci /etc/iptables/rules.v4.

Ɗauki kwafi kafin ka taɓa shi, sannan maye gurbin interface ɗin fita a layin MASQUERADE da na'urar da ka rubuta, misali -o wlan0 maimakon -o eth0. Bar kewayon tushe kamar yadda yake, sai dai idan wurin ajiyar client ɗinka ya canza. Sake loda kuma tabbatar da cewa dokar yanzu tana ambaton na'urar da ta dace:

sudo cp /etc/iptables/rules.v4 /root/rules.v4.bak
sudo iptables-restore < /etc/iptables/rules.v4
sudo iptables -t nat -L POSTROUTING -v -n

Saituna biyu maƙwabta ana mantawa da su cikin sauƙi. sysctl net.ipv4.ip_forward dole ya bayar da 1, kuma babbar rawutar ba za ta tace adiresoshin tushe na sirri da kanta ba.

Tabbatar da cewa dokar tana aiki, sannan ka ware abin da har yanzu yake jinkiri

Ƙididdiga ita ce kawai hujja ta gaskiya cewa doka ta dace. Gudanar da cikakken jeri, fara zazzagewa a client ɗin kuma sake gudanar da shi. Ginshiƙan packets da bytes kusa da dokarka ya kamata su haɓaka, kuma dokar da ta tsaya a sifili har yanzu ba ta dace ba. Idan ƙididdigan suna motsi amma shafuka har yanzu suna kasawa, kwatanta kewayon tushe da ainihin wurin ajiyar da grep -n "^server " /etc/openvpn/server.conf. Idan suna motsi kuma shafuka suna lodawa amma saurin wucewa yana da rauni, fassarar ta ƙare kuma sauran matsalar tana wani wuri.

Kwatanta wucewa biyu daga client ɗaya, ɗaya zuwa mai masaukin da ke kan cibiyar sadarwa ta gida ɗaya kuma ta tunnel zuwa wannan mai masaukin. Jinkiri a duka biyun yana nuni ga hanyar fita ta Pi ko haɗin Wi-Fi, ba VPN ba. Jinkiri ta tunnel ne kawai yana nuni ga MTU da sake aikawa, waɗanda za ka iya dubawa da ip -s link show tun0 kafin ka canza kowane saitin crypto.

Don soke gwajin, dawo da kwafin kuma sake loda shi, sannan tabbatar da cewa ainihin dokar da ƙididdiganta sun dawo. Rubuta na'urar fita da umarnin sake lodawa a cikin bayanan uwar garken, domin canjin hanyar fita na gaba zai sake gano irin wannan rashin daidaituwa. Dokar da ke ambaton na'urar da ba daidai ba tana zama marar gani har sai zirga-zirga ta buƙace ta.