Abokin cinikin VPN mai hanya ya isa sabar amma bai isa masu masaukin LAN ba

Ramí yana tashi, abokin ciniki yana ping ɗin sabar VPN, kuma wani yanki a kan na'ura mai nisa mataki ɗaya ba ya amsawa. Babu wani abu a cikin tsarin abokin ciniki da zai bayyana hakan, domin buƙatar ta bar abokin ciniki kuma ta isa. Abin da ya kasa shi ne tafiyar dawowa, kuma na'urar da ta kasa yawanci ƙofar LAN ce ba mai masaukin VPN ba. Bin diddigin fakitin amsa yana bayyana dukan rukunin alamun.

Bi Amsar, Ba Buƙatar Ba

Sabar VPN tana buɗe fakitin abokin ciniki kuma ta tura shi zuwa LAN yayin da adireshin abokin ciniki yake a filin tushe. Mai masaukin manufa yana amsa wannan adireshin, kuma yanzu teburin hanyarsa shi kaɗai ke yanke duk abu. Ƙofarsa ta asali ba ta san komai game da tafkin ramí ba, don haka amsar ta fita zuwa ga mai ba da intanet kuma an watsar da ita wani wuri a kan wannan hanya.

A wajen abokin ciniki alamar ita ce shuru mara amsa: babu ƙi, babu sake saiti, kawai babu komai. Buɗe yanki yana ratsewa, ping yana bayar da rahoton babu amsa, kuma littattafan sabar suna kama da lafiya domin sabar ta yi aikinta.

Sanya Hanyar Dawowa Inda Masu Masauki Suke Kallo

Kowane mai masaukin LAN yana tuntuɓar ƙofarsa ta asali, don haka ƙofar ita ce kawai na'urar da ta kamata ta san inda tafkin ramí yake. Ƙara hanyar tsaye a can kuma kowane mai masauki ya gaji hanyar da ta dace ba tare da an taɓa shi ba.

Idan ƙofar tana raba adireshinta a matsayin zaɓin DHCP, raba hanyar ta wannan hanya domin sabbin na'urori su ɗauke ta kai tsaye. In ba haka ba hanyar tana zaune a cikin fayil ɗaya na tsari kuma tana ɓacewa a sake gini na gaba.

# on the LAN gateway; tunnel pool 172.20.5.0/24, VPN server 10.60.4.10
ip route add 172.20.5.0/24 via 10.60.4.10
ip route get 172.20.5.14

Me Yasa NAT na Tushe Ke Kamar Yana Gyara Shi

Rufe tafkin abokan ciniki a bayan adireshin sabar VPN yana kawar da matsalar ta hanyar cire adireshin abokin ciniki daga fakitin. Sai amsoshi su koma zuwa sabar, wadda ta riga ta san yadda za a isa ramí, kuma kome yana aiki. Farashin shi ne cewa masu masauki na ciki ba za su iya ganin wanene abokin ciniki ba, kuma kowace haɗi tana kama da ta fito daga na'ura ɗaya.

Wannan musayar wani lokaci daidai ce, misali idan ba za a iya ba na'urar mai sayarwa hanyar tsaye ba. Kada ka sa ƙa'idar ta fi tafkin yanzu faɗi, domin ƙa'idar da aka rubuta don /24 tana daina dacewa ranar da aka sake lambar tafkin zuwa /16, kuma alama ta farko ita ce gungu na sabbin abokan ciniki waɗanda suke haɗawa kuma ba su isa kome ba.

iptables -t nat -A POSTROUTING -s 172.20.5.0/24 -o ens18 -j MASQUERADE
iptables -t nat -L POSTROUTING -n -v

Hanyar Girgije Tana Buƙatar Saiti Uku

A cikin VPC wannan rata ɗaya tana dawowa a wata siffa, domin ƙaramin cibiyar sadarwa ba shi da wata hanya don kewayon abokan ciniki kwata-kwata. Teburin hanya yana buƙatar shigarwa don tafkin ramí da ke nufin mu'amalar cibiyar sadarwar misalin, kuma mu'amalar tana buƙatar a kashe duba tushe da manufa domin dandamali ya karɓi fakiti waɗanda tushensu ba adireshinta ba ne. Ƙungiyoyin tsaro da ACL na cibiyar sadarwa suma dole su yarda da tafkin a duk kwatance biyu.

Kowane tsallakewa yana haifar da gazawa ta wani ɓangare daban. Ka tsallake shigarwar teburin hanya sai misalai masu zaman kansu sun amsa cikin ƙaramin cibiyar sadarwa wadda ba za ta iya ɗaukar amsar komawa tafkin ba. Yayin da duba ke kunne, dandamali yana watsar da amsar bayan misalin ya riga ya aika ta. Ba tare da ƙa'idar ƙungiyar tsaro ba buƙatar kanta ba ta isa ba, kuma abokin ciniki yana ganin shuru mataki ɗaya da wuri.

Gudanar da Dubawa a Wannan Tsari

Tabbatar da turawa gaba da manufar tacewa kafin ka zargi hanyar, domin mai masaukin da ba zai tura gaba ba yana kasa a cikin wannan shuru ɗaya. Sannan karanta ingantaccen saitin hanyar baya a kan mu'amalar da ke ɗaukar ramí, domin mai tacewa mai tsauri na iya watsar da amsoshi da suke zuwa daga wata hanya da ba a zata ba.

Kammala da ɗaukar hoto a kan mai masaukin LAN yayin da abokin ciniki ke ping ɗinsa. Buƙatar da ta zo ba tare da amsa da ta dace ba tana tabbatar da hanyar dawowa, kuma buƙatar da ba ta taɓa zuwa ba tana mayar da laifin zuwa sabar ko ramí.

sysctl net.ipv4.ip_forward net.ipv4.conf.all.rp_filter
tcpdump -ni any host 172.20.5.14 and icmp

An rubuta duba tushe da manufa a cikin jagorar mu'amalar cibiyar sadarwa mai sassauci. Saita ta a kan mu'amalar da ke ɗaukar zirga-zirgar ramí da gaske, ba a kan wani adafta mara alaƙa da ke haɗe da wannan misali ba.