Masu amfani na nesa ba sa isa waje na biyu ta cibiyar VPN

Wani mai amfani na nesa yana haɗawa da cibiyar, ya isa uwar garken fayil da ke kan LAN ɗin cibiyar kanta, kuma komai ya yi kyau. Sannan ya buɗe wani rabo a kan 10.20.0.50 a babban ofishin, wanda cibiyar ke isa ta wata tunnel na waje-zuwa-waje daban, kuma lokacin ya kare. Duka tunnel ɗin suna aiki kuma duka kididdiga biyu suna hauhawa, don haka babu tunnel ɗin da ya lalace. Ketarewa ta cibiyar shine shawarar hanya uku a kan na'urori uku, kuma tunnel ɗin yana ɗaukar prefix ɗin da aka gina shi dominsu kawai. Ga tsarin da nake bincikawa, da umarnin da ke nuna ko kowane mataki gaskiya ne.

Wucewa tana bukatar bincike uku, ba tunnel ɗaya ba

Kowace na'ura tana yin nata daidaiton prefix mafi tsawo sannan ta manta da shi. Kwamfutar tafi-da-gidanka dole ta aika 10.20.0.50 cikin tunnel ɗin maimakon zuwa na'urar hanya ta gida. Cibiyar dole ta karɓi fakiti da ya zo kan muƙaƙƙen hanyar isa daga nesa sannan ta miƙa shi ga muƙaƙƙen hanyar waje-zuwa-waje. Babban ofishin dole ya aika amsa don adireshin mai amfani ta cikin tunnel ɗin. Duk ɗaya daga cikin ukun da ya kasa yana kama da ɗaya a cikin burauza: shiru.

Shi ya sa gwada kowane tunnel shi kaɗai yana tabbatar da kaɗan. Yin ping ga adireshin LAN na cibiyar yana gwada shawarar farko, yin ping ga cibiyar daga babban ofishin kuma yana gwada ta uku. Fakitin da ya kasa yana da rukunin masu amfani a matsayin tushe da waje na biyu a matsayin manufa, don haka fara rubuta waɗannan prefixes. A nan rukunin shine 10.80.0.0/24, LAN ɗin cibiyar shine 10.10.0.0/24 kuma babban ofishin shine 10.20.0.0/24.

Tura prefix ɗin nesa zuwa abokin ciniki na nesa

A kan OpenVPN uwar garken isa daga nesa, abokin ciniki yana koyon hanyoyi a lokacin haɗawa. Ba tare da push ba, abokin ciniki mai tunnel ɗin raba yana aika 10.20.0.50 zuwa kofar kansa kuma fakitin ba ya shiga tunnel ɗin.

push "route 10.20.0.0 255.255.255.0"

Hanyar da aka tura tana aiki lokacin da abokin ciniki ya haɗa, don haka mai amfani da ya ci gaba da kan layi ba ya ganin komai har sai ya sake haɗawa. Tabbatar a kan abokin ciniki: ip route get 10.20.0.50 a Linux, route print a Windows. Fitarwa ya kamata ta ambaci muƙaƙƙen hanyar tunnel ɗin.

Push ba ya taimaka wa cibiyar. Saƙo ne zuwa ga abokin ciniki, ba hanya ba a kan uwar garken kuma ba izini ba don turawa, don haka cibiyar da ke da cikakken layin push har yanzu tana zubar da kwararar bayan tsalle ɗaya. Wannan shine dalilin da ya saba sa mutane su yi tsammanin push ɗin ya kasa.

Ba cibiyar hanyar fita ta gaske

Cibiyar tana bukatar nata tsallen gaba don prefix ɗin babban ofishin. A kan tunnel mai hanya wannan hanya ce ta yau da kullum ta muƙaƙƙen hanyar waje-zuwa-waje, kuma umarni ɗaya yana nuna duka hanyar da aka zaɓa da tushen da aka zaɓa:

ip route get 10.20.0.50 from 10.80.0.25
sudo ip route add 10.20.0.0/24 via 172.30.0.2 dev s2s0

Inda ɓangaren waje-zuwa-waje shi kansa OpenVPN ne, hanyar na iya zama a cikin wannan saitin tare da adireshin tunnel ɗin abokin tarayya a matsayin kofa: route 10.20.0.0 255.255.255.0 172.30.0.2. Kofar ba ta zama dole ba. Idan ka bar ta, tsallen gaba yana faɗo ga tsohuwar kayyadaddun aiwatarwa, wadda ta bambanta tsakanin abokin ciniki mai nesa ɗaya da cibiyar mai abokan tarayya da yawa.

IPsec na tushen manufa ya bambanta: kernel ɗin cibiyar yana aika fakitin zuwa kofar LAN ta yau da kullum kuma manufar tana kamawa yayin fita, don haka hanyar tunnel ko ba ta yin komai ko tana karkatar da zirga-zirga ta wuce manufar. Kula da tushe a cikin umarnin da ke sama, domin 10.10.0.1 maimakon adireshin rukunin yana nufin kernel ɗin ya zaɓi adireshin da gefen nesa zai ki. iroute ma ba shine amsar ba; yana gaya wa uwar garken wane abokin ciniki ne ya mallaki subnet a bayan tunnel ɗin kansa, ba inda za a aika zirga-zirga don waje na uku ba.

Faɗaɗa gefen nesa zuwa rukunin masu amfani

Babban ofishin ya riga ya rufe LAN ɗin cibiyar, 10.10.0.0/24. Rukunin masu amfani shine prefix na biyu kuma dole ya kasance a cikin masu zaɓe kuma, in ba haka ba babu wata manufa da ke rufe amsa da aka aika zuwa 10.80.0.25. Kowanne abokin tarayya yana ambaton wannan biyun na saitin prefixes daga ɓangarensa:

# strongSwan swanctl.conf, on the hub
local_ts  = 10.10.0.0/24, 10.80.0.0/24
remote_ts = 10.20.0.0/24

# on the headquarters peer
local_ts  = 10.20.0.0/24
remote_ts = 10.10.0.0/24, 10.80.0.0/24

local_ts na wata na'ura shine remote_ts na ɗaya. Kwafi block ɗin cibiyar zuwa babban ofishin sai biyun su juya, don haka SA ɗin yaro ba ya tashi.

Tsohon tsarin ipsec.conf yana amfani da leftsubnet da aka raba da waƙafi. Kungiyar tsaro da ke gudana tana rike da masu zaɓen da ta tattauna, don haka sake kafa tunnel ɗin bayan gyara. Mai zaɓe da aka canza a 10:00 kuma aka gwada da SA da ya tashi a 09:40 har yanzu yana kasa, yayin da fayil ɗin saitin ya ke da kyau duk tsawon lokaci.

Sannan duba tsallen karshe. ip route get 10.80.0.25 a kan karshen nesa ya kamata ya nuna cikin tunnel ɗin. Idan sabis ɗin yana amfani da na'urar hanya ta LAN a matsayin kofarsa ta asali, wannan na'urar hanya tana bukatar hanyar dawowa kuma, in ba haka ba amsar tana mutuwa a can. Gudanar da tcpdump -ni eth1 host 10.80.0.25 a wannan ɓangaren yana nuna ko amsar ta bar karshen kwata-kwata.

Yarda da kwararar a cibiyar

Dole a kunna turawa kuma a yarda da hanyar. Iyakance ka'idojin ga prefixes biyun maimakon karɓar komai tsakanin muƙaƙƙen hanyoyin.

sysctl -w net.ipv4.ip_forward=1
iptables -I FORWARD -i tun0 -o s2s0 -s 10.80.0.0/24 -d 10.20.0.0/24 -j ACCEPT
iptables -I FORWARD -i s2s0 -o tun0 -s 10.20.0.0/24 -d 10.80.0.0/24 -j ACCEPT

Tacewar hanyar dawowa ita ce gazawar shiru da ke gefenta: idan ɓangarorin biyu suna kan muƙaƙƙen hanyoyi daban-daban, rp_filter=1 na iya zubar da amsar yayin da ma'aunin ka'idar karɓa ba ya motsi. Kwatanta iptables -vnL FORWARD kafin da bayan wani yunkuri. Ka'idar da ba ta taɓa karuwa ba ba a kai mata, don haka duba wani Layer a kasa maimakon sake rubuta ta.

Idan rukuni ɗaya ne kawai ke bukatar wucewa, sanya hanyar a cikin fayil na kowane abokin ciniki a karkashin client-config-dir maimakon faɗaɗa push ɗin gaba ɗaya. Source NAT a cibiyar kuma yana kawar da bukatar hanyar dawowa ta gefen nesa, amma yana ɓoye adireshin mai amfani, don haka rajistan ayyukan waje na nesa da ka'idojin tushen adireshi sun daina bambanta masu amfani.

Tabbatar daga abokin ciniki, sannan ka koma baya a jere

Gwada tashar TCP, ba ICMP kawai ba, domin ping na iya wucewa yayin da sabis ɗin ya ci gaba da toshewa. nc -vz 10.20.0.50 445 da traceroute -n 10.20.0.50 daga abokin ciniki suna nuna ko tsalle na biyu shine adireshin tunnel ɗin cibiyar. A cibiyar, tcpdump -ni tun0 host 10.20.0.50 da wannan tacewa a kan muƙaƙƙen hanyar waje-zuwa-waje: bukata a duka biyu ba tare da amsa a kowanne ba tana motsa matsalar zuwa gefen nesa.

Sannan gwada wani abu da ya kamata ya ci gaba da toshewa. Idan na'urar da rukunin bai kamata ya taɓa isa ba ita ma ta amsa, ka buɗe fiye da wucewa kuma ya kamata ka takaita ka'idojin. Cibiyar da ke tura komai zuwa kowane reshe tana wucewa gwajin farko kuma ta kasa na biyu.

Rike jerin koma baya, domin an canza abubuwa huɗu kuma uku suna da sauƙin mantawa: hanyar da aka tura, hanyar cibiyar, masu zaɓe da ka'idojin bangon wuta. Mayar da su a jere, sake kafa SA, kuma ka sa mai amfani ɗaya ya sake haɗawa. Koma baya na wani ɓangare yana barin hanya da ke nuni ga tunnel wanda bai sake daidaitawa ba, wanda ya fi shiru na asali wuyar karantawa. Jagorar OpenVPN 2.6 yana rubuta push, route da iroute don sigar ku.