Buga tashar abokin ciniki ta VPN daga bayan CGNAT: jerin dubawa

Sanya sabis a kan kwamfutar tafi-da-gidanka a bayan NAT na matakin mai ɗaukar nauyi, kai wannan kwamfutar zuwa VPS ta hanyar VPN, kuma babu wanda daga waje zai iya isa gare ta. Kuna ƙara dokar NAT ta manufa a kan VPS kuma kuna samun wani abu mafi muni fiye da shiru: haɗin kai yana buɗewa, sannan ya tsaya. Amsar ba ta ɓace ba, tana fita ta hanyar da ta dace ta abokin ciniki da kansa, wanda ke nufin uwar garken ba ta taɓa ganin ta ba. Yi waɗannan gwaje-gwaje biyar cikin tsari kuma tsaya a farkon wanda bai tsaya ba.

Tabbatar cewa uwar garken zai wuce da komai

Yi alama a wannan akwatin kafin ka rubuta fassarar ko ɗaya. Dokar DNAT ga fakiti da kernel ya ƙi wucewa mai nazarin dokoki yana karɓa sannan hanyar wucewa ta watsar da shi, wanda ke haifar da jinkiri wanda ke kama da matsalar bangon wuta.

sysctl net.ipv4.ip_forward
sysctl -w net.ipv4.ip_forward=1

Saita shi a cikin kernel mai gudana ba daidai yake da saitawa a tsawon sake yi ba. Rubuta net.ipv4.ip_forward=1 a cikin fayil a ƙarƙashin /etc/sysctl.d/, gudanar da sysctl --system, sannan karanta darajar baya maimakon dogara cewa an ɗauki fayil ɗin. Kwandon da ke sarrafa nasa sararin sunan cibiyar sadarwa yana buƙatar wannan darajar a cikin wannan sarari, ba a kan mai masauki kaɗai ba.

Idan karatun baya har yanzu sifili ne, tsaya a nan. Babu wani abu a ƙasa da zai yi aiki.

Ƙulla adireshin ramin kafin kowace doka ta ambace shi

Tafkin yana ba da adireshi cikin tsarin haɗin kai, don haka dokar da aka rubuta don hayar yau na iya nuni a hankali ga wani abokin ciniki mako mai zuwa. Ka ɗaure adireshin ga asalin takardar shaida maimakon tsarin zuwa.

client-config-dir /etc/openvpn/ccd
ifconfig-push 10.77.0.14 10.77.0.13

Wannan biyu su ne ƙarshen abokin ciniki da ƙarshen abokin tarayya na rami na aya-zuwa-aya, tare da uwar garken an maɓalli a kan sunan gama gari na takardar shaida. A ƙarƙashin tsarin yanar gizo na reshe ana karanta darajar ta biyu a matsayin abin rufe fuska maimakon, don haka rubuta siffar da ta dace da tsarin da ake amfani da shi. Sannan sake haɗa abokin ciniki kuma karanta adireshin a kan abokin ciniki da kansa, domin ra'ayin uwar garken game da tafkin ba hujja ba ce ga abin da abokin ciniki ya daidaita.

Idan adireshin ya canza bayan sake haɗawa, tsaya. Dokar NAT da ke bin manufa mai motsi za ta gaza lokaci-lokaci kuma ba za ta koya muku komai ba.

Fassara a duka hanyoyi biyu

Fassarar manufa tana aika fakitin shigowa zuwa ga abokin ciniki. Fassarar tushe ita ce ke sa abokin ciniki ya amsa wa uwar garken maimakon mai aikawa na asali, kuma ita ce dokar da mutane suke barin.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 29443 -j DNAT --to-destination 10.77.0.14:29443
iptables -t nat -A POSTROUTING -d 10.77.0.14 -p tcp --dport 29443 -j SNAT --to-source 10.77.0.13

Ba tare da dokar ta biyu ba abokin ciniki yana amsawa ta hanyar haɗin ISP ɗinsa na sama, don haka abokin tarayya mai nisa yana ganin adireshin tushe wanda bai taɓa magana da shi ba, yayin da uwar garken ba ta da wani rikodin bin diddigin amsar. Mai kallo daga waje yana ganin musafaha da ke cika rabi, kuma wannan shi ne ainihin alamar da ke tura mutane neman kuskuren bangon wuta wanda babu shi.

Karanta duka dokoki biyu da iptables -t nat -S kuma tabbatar cewa sunan mahaɗin shi ne wanda ke ɗauke da adireshin jama'a. A kan mai masauki wanda tuni yake tacewa da nftables, rubuta fassarar a cikin sarkar NAT na nftables na dangin adireshin da ya dace maimakon haɗa kayan aiki.

Bar teburin tacewa ya wuce

Tebur NAT suna sake rubuta kawunan; ba sa ba da izini. Da manufar DROP ta asali kwararar da aka wuce tana buƙatar nata yarda, tare da hanyar dawowa wadda yawancin manufofi tuni suka rufe da dokar established,related.

iptables -A FORWARD -i eth0 -o tun0 -p tcp --dport 29443 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Duba manufar sarkar FORWARD kafin ƙara wani abu, domin tsarin DROP na farko shi ne ke yanke hukunci ko za a taɓa tuntuɓar dokarka. A kan mai masauki wanda tacewarsa ke zaune a nftables, ƙara daidaitacciyar doka zuwa ƙugiya ta forward na teburin inet kuma tabbatar cewa tushen sarkar da gaske yana ganin zirga-zirgar da aka wuce ba kawai shigarwar gida ba. Idan ma'aunin fakiti a sabuwar doka ya tsaya a sifili yayin da ma'aunin NAT ke tashi, ana watsar da fakitin kafin dokarka. Wannan ita ce alamar karanta tsarin sarƙoƙi, ba ƙara kwafin doka ɗaya na biyu ba.

Tabbatar da shi daga cibiyar sadarwa ta waje

Gwada daga cibiyar sadarwa da ba ta da alaƙa. Bincike daga wata na'ura a cikin LAN ɗaya na iya wuce ta goyon bayan hairpin NAT kuma ba ya taɓa yin amfani da hanyar da abokin ciniki mai nisa ke amfani da ita, don haka koren sakamako a can yana tabbatar da abin da bai dace ba.

tcpdump -ni any port 29443
conntrack -L | grep 29443

Gudanar da ɗaukar hoto a kan uwar garken da kuma a kan abokin ciniki a lokaci ɗaya. Ɗaukar hoton uwar garken yana nuna ko fassararren fakitin yana fita zuwa ramin; ɗaukar hoton abokin ciniki yana nuna ko buƙatar ta iso da kuma inda aka nufa amsar. Shigarwar fassara a cikin conntrack -L tana tabbatar cewa dokar ta dace, kuma rashinta yana tabbatar cewa fakitin bai taɓa isa sarkar NAT ba.

Masu binciken tasha shaida ne marasa ƙarfi. Suna bayar da rahoton tashar a matsayin rufaffiyar har sai an ɗaure aikace-aikacen kuma yana saurara, don haka yi amfani da haɗin gaske zuwa sabis na gaske. Lokacin da ya yi aiki a ƙarshe, ka riƙe bayyanar ga wannan tasha ɗaya: wucewa SSH ko kwamitin gudanarwa saboda dokar farko ta ji ba dadi yanke shawara ce mafi girma fiye da buga sabis.