Tura tashar jiragen ruwa zuwa WireGuard peer a bayan NAT: DNAT tare da SNAT

Wani burauza yana neman https://203.0.113.10:8443, proxy ɗin yana karɓar haɗin, kuma sabis ɗin da ke kan WireGuard peer ɗin ba ya amsawa ko da yaushe. Ka’idar DNAT tana yin aikinta; amsar ita ce ɓangaren da ke gazawa. Bi fakitin ta cikin fassarorin biyu kuma ka’idar da ta ɓace ta bayyana. Gyaran shine ƙarin bayanin NAT ɗaya a cikin hook ɗin da ya dace, ba sabon tunnel ba.

Bi buƙata ɗaya daga farko zuwa ƙarshe

Buƙatar tana isa ga bayanan jama’a na proxy ɗin, tare da adireshin jama’a na abokin ciniki a matsayin tushe da adireshin proxy ɗin a matsayin manufa. A cikin nat PREROUTING ka’idar DNAT tana sake rubuta manufar zuwa adireshin tunnel na peer ɗin, 10.90.0.2. Sa’an nan shawarar turawa tana aika fakitin waje ta wg0, kuma hanyar turawa ta cika.

A kan peer ɗin fakitin yanzu yana ɗauke da ainihin adireshin tushe na jama’a, domin babu abin da ya sake rubuta shi. Sabis ɗin yana karɓar haɗin kuma yana aika amsarsa zuwa ga ƙofarsa ta tsoho, wadda ita ce rufin gida da ke gaban peer ɗin. Wannan rufin ba shi da wani yanayi don kwarara da bai taɓa gani ba kuma ko dai yana watsar da fakitin ko yana fassara shi zuwa adireshinsa na jama’a, wanda abokin ciniki ba zai karɓa ba.

Rashin daidaito shine dukan matsalar: buƙatar tana wucewa ta proxy ɗin, kuma amsar tana ƙoƙarin tafiya kai tsaye. Bin diddigin haɗin proxy ɗin yana taimakawa ne kawai idan amsar ta dawo ta proxy ɗin, kuma ba za ta iya dawowa can ba yayin da adireshin tushe har yanzu yana nuni ga ainihin abokin ciniki.

Ƙara fassarar dawowa

Sake rubuta tushen kwararar da aka tura zuwa adireshin tunnel na proxy ɗin kafin ya tashi zuwa peer ɗin. Sa’an nan sabis ɗin yana amsa zuwa 10.90.0.1, proxy ɗin yana karɓa, kuma bin diddigin haɗi yana juya fassarorin biyu kafin fakitin ya koma ga abokin ciniki.

iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Ka’idar POSTROUTING tana da kunkuntar da gangan: tana dacewa da manufar da aka fassara da kuma bayanan tunnel ɗin, don haka ba ta sake rubuta wasu zirga-zirgar da ba su da alaƙa waɗanda ke fita ta wg0. Wata faffadar ka’idar masquerade ita ma za ta ɓoye adireshin abokin ciniki, amma za ta yi hakan ga kowace kwarara kuma ta sa teburin NAT ya fi wahalar dubawa.

Sanya ka’idoji inda tunnel ɗin yake

Ka’idojin da ke magana da adireshin tunnel ko bayanan sa dole su gudana bayan wg-quick ya saita shi. Ana ƙirƙirar bayanan kafin PreUp, amma adiresoshi, MTU, DNS da hanyoyi ana amfani da su bayan haka, kuma PostUp yana gudana da zarar duk wannan yana wurinsa. Saka ƙarin a cikin PostUp da cirewa a cikin PreDown.

PostUp = iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PostUp = iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1
PreDown = iptables -t nat -D PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PreDown = iptables -t nat -D POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Cirewa dole su dace da ƙarin token da token, gami da dacewar multiport da bayanai. Cirewar da ta bambanta a dacewa ɗaya ba ta cire kome ba, kuma haɗin gaba yana ƙara kwafin ka’idar na biyu. Bayan wasu haɗe-haɗe teburin yana ɗauke da kwafi waɗanda ke da wuya a danganta su da layin saiti.

Duba sakamakon da iptables -t nat -S bayan sake haɗawa. Idan ka’idar ɗaya ta bayyana sau biyu, layin PreDown bai dace ba kuma tsaftacewar tana gazawa cikin shiru.

Turawa, tacewa da sauran NAT

Kunna turawar IPv4 na dindindin, sannan ka ba da izinin kwararar da aka tura a cikin teburin tacewa. DNAT yana faruwa kafin sarkar FORWARD, don haka ka’idar tacewa tana dacewa da manufar da aka fassara maimakon adireshin jama’a. Idan UFW ke kula da bangon wuta, bayyana izinin a matsayin ka’idar hanya; ka’idar mai masaukin talakawa ba ta rufe zirga-zirgar da aka tura.

Wasu nau’ikan NAT biyu na iya karya hanyar ko da ka’idojin proxy ɗin suna daidai. A haɗin gida, adireshin jama’a na rufin ne, kuma buɗe tashar a cikin bangon wutarsa ba daidai yake da ƙirƙirar shigarwar tura tasha da ke aika wannan tashar zuwa proxy ɗin ba. Tashar da ta bayyana a buɗe daga waje yayin da babu abin da ke amsawa sau da yawa ba ta da wannan taswirar.

A kan NAT VPS, mai bayarwa yana taswira tashar jama’a zuwa adireshi na sirri. Taswirar dole ta dace da tashar da kuke sanarwa, kuma rashin daidaituwa yana kama da karyayyen tunnel. Tabbatar da taswirar mai bayarwa kafin canza saitin WireGuard.

Tabbatar da hanyar dawowa kuma ka karɓi kuɗin

Haɗa daga hanyar sadarwar da ba LAN na proxy ɗin ba, sannan duba nau’in fassarar yayin da haɗin ke buɗe:

conntrack -L -p tcp --dport 8080
tcpdump -ni any tcp port 8080

Shigarwar conntrack ya kamata ta nuna ainihin tuple, tuple ɗin da aka fassara da alkiblar amsa. Idan amsar ba ta nan, peer ɗin ba ya aikawa ta tunnel ɗin, wanda yawanci yana nufin ba a yi amfani da ka’idar SNAT ba ko kuma bangon wutar peer ɗin da kansa ya watsar da kwararar.

Sake yi sau ɗaya don tabbatar da cewa PostUp yana sake amfani da ka’idojin, sannan ka dakatar da tunnel ɗin kuma ka tabbatar PreDown ya cire su. Matattun ka’idojin da ke tsira bayan katsewar haɗi sune dalilin da yasa canji na gaba ke yin hali ba tare da annabta ba.

A ƙarshe, karɓi abin da SNAT ke kashewa. Sabis ɗin yana ganin kowace buƙata a matsayin ta fito daga proxy ɗin, don haka rajistan shiga, iyakar saurin kowane abokin ciniki da jerin adiresoshin da aka yarda ba su ƙara bambanta masu amfani ba. Shari’ar hairpin tana buƙatar fassarar tushe nata ga abokan ciniki a LAN na proxy ɗin. Idan peer ɗin yana buƙatar ainihin adiresoshin abokan ciniki, madadin shine hanyar dawowa zuwa hanyar sadarwar abokin ciniki, wanda ya fi aiki amma yana adana bayanin.