Prefix na jama'a ta hanyar OpenVPN: gyara hanyar dawowa

Ka kalli yadda tunnel ɗin ke tasowa kuma abokin ciniki yana ping ɗin wancan gefen, sannan adireshin jama'a da ke bayan VPN yana amsawa daga wani wuri, ko kuma ba ya amsawa kwata-kwata. Wannan alamar yawanci ba ta da alaƙa da cipher ko takaddun shaida. Ana isar da prefix da mai bayarwa ya yi routing a matsayin hanyar IP, kuma ɗaukarsa ta OpenVPN yana nufin sake haifar da wannan hanya a matakai biyu da kiyaye adireshin tushe a hanyar dawowa. Ba a buƙatar haɗa WAN da gada, kuma ƙara adireshin cikin interface ba ya ƙirƙirar hanyar sama.

Dole ne a fara yi wa prefix ɗin routing zuwa gare ku

Tambayi mai bayarwa yadda ake isar da block ɗin. Prefix da aka yi routing zuwa babban adireshin uwar garken ku ya bambanta da adiresoshin da mai bayarwa ke tsammanin isa kai tsaye a kan sashin WAN. Samfurin farko ne kawai ke aiki da tsarin da ke nan.

Idan mai bayarwa ya yi routing ɗin 198.51.100.64/28 zuwa uwar garken shigarku, fakitin wannan yanki suna isa uwar garken kuma suna tsayawa a can sai dai idan kun tura su gaba. Idan kuma mai bayarwa ya haɗa yankin da gada zuwa uplink ɗinku, dole ne uwar garken ta amsa ARP dominsa, wadda wata matsala ce daban.

Gwada samfurin isarwa kafin ku taɓa OpenVPN: daga waje, yi ping ɗin wani adireshi a cikin block ɗin kuma ka ga wace interface ce ke karɓarsa. Idan babu abin da ya iso, babu wani saitin tunnel da zai taimaka. Idan adireshin yana amsawa kai tsaye a kan WAN, mai bayarwa yana haɗa da gada maimakon yin routing, kuma tsarin da ke ƙasa bai dace ba.

Matakai biyu na routing: hanyar kernel da iroute

OpenVPN yana buƙatar prefix ɗin a wurare biyu. Dole ne kernel ya san cewa prefix ɗin na na'urar tunnel ce, domin fakitin da aka tura gaba su shiga OpenVPN maimakon hanyar da aka saba. Dole kuma OpenVPN ya san wane abokin ciniki da aka tabbatar shi ne ya mallaki prefix ɗin, kuma wannan shi ne shigarwar iroute a cikin babban fayil ɗin da ya keɓanta da abokin ciniki.

Hanyar gefen uwar garke tana kama da haka, inda prefix da mask ɗin dole su dace da rabon:

ip route add 198.51.100.64/28 dev tun0

Saitin da ya keɓanta da abokin ciniki yana ba da mallaka. Ka saka shi a cikin fayil ɗin CCD da aka yi wa suna da sunan gama gari na takardar shaidar abokin ciniki, kuma ka tabbatar wannan babban fayil ɗin shi ne wanda uwar garke ke karantawa da gaske:

iroute 198.51.100.64 255.255.255.240

Dokar OpenVPN kan hanyoyin sadarwar da aka yi routing tana bayyana matakan biyu da dalilin da ya sa suka bambanta. Hanyar kernel ba tare da iroute tana aika fakiti cikin tunnel ba tare da mai shi ba, kuma OpenVPN yana jefar da su. iroute ba tare da hanyar kernel tana barin fakiti a kan hanyar da aka saba ta uwar garke. Duk waɗannan kurakurai suna kama da tunnel da ya lalace daga gefen abokin ciniki.

Inda adireshin sabis yake

Prefix ɗin da aka ba da shi ba ɗaya yake da adiresoshin tunnel ɗin kansa ba. Ka yi wa hanyar lamba daga sararin sirri idan kana so, kuma ka sanya adireshin sabis na jama'a a inda sabis ɗin yake gudana da gaske.

A kan abokin ciniki na Linux wanda ke ƙarasa sabis ɗin a gida, adireshin host ɗaya ya isa:

ip address add 198.51.100.70/32 dev lo

Idan an yi routing ɗin prefix ɗin gaba zuwa wata uwar garke ta VM ko wata LAN, sai ka saita wannan hanyar ƙasa da hanyar dawowarta maimakon haka. Ba a buƙatar ba da kowane adireshi a cikin block ɗin ga abokin ciniki na VPN, kuma hakan yana haifar da rikici daga baya.

Ka kiyaye tushen jama'a a hanyar dawowa

Amsa daga prefix ɗin da aka ba da dole ta fita ta cikin tunnel kuma ta isa hanyar mai bayarwa. Idan uwar garke mai nisa ta aika ta ta ISP ɗinta, adireshin tushe yana kama da na jabu, kuma mai bayarwa ko inda aka nufa suna jefar da ita. Maganin shi ne ƙa'ida da ta dogara da tushe ko teburin routing na musamman, ba faffadan NAT ba. Ba tare da ita ba, sabis ɗin yana aiki daga abokin tunnel ɗin kuma yana gazawa daga kowane wuri.

A uwar garken shiga, faffadan ƙa'idar masquerade ita ce ta al'ada. Tana sake rubuta tushen jama'a zuwa babban adireshin uwar garke, kuma abokin ciniki ba ya taɓa ganin na gaske:

iptables -t nat -S POSTROUTING

Ka iyakance NAT ga abokan ciniki na VPN masu zaman kansu waɗanda suke buƙatarsa kuma ka bar prefix ɗin da aka ba da ba a fassara shi ba. Sannan ka tabbatar uwar garke tana tura prefix ɗin gaba kwata-kwata, domin sarkar turawa da ke ƙin a matsayin na asali tana jefar da shi a hankali.

Ka tabbatar da duka kwatance biyu kafin ka amince da shi

Tabbatarwa abubuwan lura huɗu ne, ba ɗaya ba. Ka tabbatar hanyar mai bayarwa ta iso, kernel yana aika prefix ɗin cikin tunnel, OpenVPN yana danganta shi da abokin ciniki da ya dace, kuma amsar tana dawowa da tushen jama'a cikakke. Kowace lura tana da nata umarnin, don haka gazawa tana nuna wani mataki maimakon dukan tsarin. Ka gudanar da su a wannan jeri bayan kowane canjin saiti.

Tambayi kernel wace hanya adireshin da aka ba da zai bi, kuma ka lura da tunnel ɗin yayin da ake gudanar da buƙata:

ip route get 198.51.100.70
sudo tcpdump -ni tun0 host 198.51.100.70

Tacewar hanyar baya na iya soke ingantacciyar hanya. Ka duba ingantaccen saitin a kan tunnel da kuma a kan uplink, kuma ka tuna cewa yanayin tsauri yana ƙin zirga-zirgar da tushenta bai dace da interface ɗin da ya iso ba:

sysctl net.ipv4.conf.tun0.rp_filter net.ipv4.conf.eth0.rp_filter

A ƙarshe, gwada yanayin gazawa. Ka tsayar da tunnel ɗin kuma ka tabbatar prefix ɗin jama'a ba ya yoyo ta hanyar uplink ta yau da kullum. Maido da VPN ya kamata ya dawo da sabis ɗin ba tare da faɗaɗa waɗanne tashoshin da uwar garke ke buɗewa ba.