VPN da LAN na gida suna amfani da subnet ɗaya: fara bin hanyar

Kana haɗawa da VPN na ofis, alamar a tray ɗin ta zama kore, intranet ɗin yana lodawa, sai printer ɗin da ke nisan mita biyu ya daina amsawa. Raba abin da ya yi aiki da safe yana ƙarewa a kan na'urar guda, kuma babu wani log da ya ambaci printer. Amma motsin farko shi ne DNS, domin sunan da ba ya warwarewa yana kama da sunan da babu shi, amma adireshin ne matsalar: adaftan biyu yanzu suna da'awar 192.168.1.0/24 kuma hanya ɗaya ce kawai za ta iya lashe wannan prefix. Bi shi a wannan tsari kuma za ka ga wane adaftan ya ɗauke shi kafin ka canza wani abu.

Fara daga alamar, ba daga tunnel ɗin ba

Alamar ita ce iyaka. Idan intranet ɗin yana aiki kuma kowace na'urar gida ta kasa, tunnel ɗin yana lafiya kuma hanyar gida ba ta lafiya. Idan na'urorin gida suna aiki kuma intranet ɗin ya kasa, akasin haka. Idan komai yana aiki sai host ɗaya, kana fuskantar adireshi ɗaya da ke wanzuwa a ɓangarorin biyu.

Rubuta adireshin gida ɗaya da adireshin nesa ɗaya kafin ka taɓa wani saiti. “Printer” ba a iya gwada shi ba; 192.168.1.40 ana iya gwada shi. Wannan mataki ɗaya yana hana sa'ar da aka fi ɓata a wannan matsala, wato sake rubuta saitin DNS saboda shawaran hanya.

Mataki 1: ga adaftan biyu suna da'awar prefix ɗin

Buɗe Haɗin Sadarwa (ncpa.cpl) ka karanta adaftan biyu gefe da gefe. Adaftan Ethernet yana nuna 192.168.1.50/24 tare da gateway 192.168.1.1. Adaftan VPN yana nuna 192.168.1.201/24, wanda uwar garken ta tura. Dukansu halal ne, dukansu sun yi imani prefix ɗin on-link ne, kuma stack ɗin zai riƙe hanya ɗaya dominsa.

Get-NetIPAddress -AddressFamily IPv4 yana lissafa adiresoshin, kuma Get-NetIPInterface | Sort-Object InterfaceMetric yana nuna tsarin da stack ɗin zai yi amfani da su. Wannan ginshiƙin metric shi ne shawarar da za ka karanta yanzu, don haka rubuta lambobin maimakon ƙoƙarin tuna su.

Tabbatar da kuskuren ka'idar DNS cikin sauƙi: Resolve-DnsName printer.office.lan yana mayar da adireshin da ya mayar da shi jiya. An warware sunan; sai fakitin ya fita ta adaftan da ba daidai ba. Minti biyu a nan suna ceton yammaci a cikin saitunan mai warwarewa.

Mataki 2: karanta hanyar da ta yi nasara da gaske

Find-NetRoute -RemoteIPAddress 192.168.1.40 yana buga interface, tsalle na gaba da tushen da stack ɗin zai yi amfani da su ga wannan adireshin. Ɗauki wannan fitarwa a matsayin amsa, ba alama ba. route print -4 yana ba da dukan teburin idan kana son ganin wane shigarwa ya sha kaye da nawa.

Keɓancewa yana cin niyya. 192.168.0.0/25 da aka tura yana cin nasara kan 192.168.0.0/24 na gida domin prefix ɗin ya fi tsayi, don haka 192.168.0.0 zuwa 192.168.0.127 suna fita ta tunnel yayin da rabin sama ya kasance na gida. Ɓacewar rabin LAN ba tare da saƙon kuskure ba shine halin da ya dace ga wannan teburin.

tracert -d 192.168.1.40 yana tabbatar da haka daga wajen teburin: idan tsalle na farko adireshin tunnel ne maimakon na'urar router ɗinka, to hanyar ita ce dukan labarin. A Linux tambayar ɗaya ita ce ip route get 192.168.1.40, wanda ke buga adireshin tushe da na'urar a layi ɗaya. Idan amsar ta ambaci tun0, daina kallon browser ɗin.

Mataki 3: duba hanyar dawowa kafin ka zargi abokin ciniki

Daidaitaccen hanyar gaba har yanzu yana kasawa idan ɓangaren nesa ba zai iya amsawa ba. Idan an isa LAN na abokin ciniki ta tunnel, dole gateway na wannan LAN ya san inda tafkin tunnel yake: ip route add 10.8.0.0/24 via 192.168.1.12 a wannan router, da push “route 192.168.1.0 255.255.255.0” daga uwar garken domin abokan ciniki su san hanyar dawowa.

Ba tare da shigarwa ta farko amsar tana barin manufar zuwa ga gateway ɗinta na asali, wanda ke tura adireshin sirri ga ISP sannan ya jefa shi. Alamar ta gefe ɗaya ce kuma ana iya karanta ta da kuskure: buƙatun suna bayyana akan tun0, amsoshin ba su kasance ba.

Dokar masquerade a kan host ɗin VPN tana kawar da buƙatar wannan hanyar tsaye: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE. Hakanan tana ɓoye ainihin adiresoshin tushe, wanda ke sa kowace tambaya ta log daga baya ta yi wuya. Host ɗin manufa da kuskuren gateway na asali yana haifar da wannan shirun, tare da ICMP redirect a mafi kyawun yanayi da baƙin rami a na yau da kullum, shi ya sa ɗaukar hoton ya dace a ƙarshen biyu.

Mataki 4: zaɓi gyaran da za ka iya rayuwa da shi

Ana amfani da gyare-gyare biyar ga wannan, kuma ba sa musanya. Zaɓi gwargwadon abin da dole ya kasance ana iya isa a lokaci ɗaya, ba gwargwadon wane umarni ya fi guntu ba.

Metric ɗin shine zaɓi mafi sauƙi kuma wanda mutane ke fara ɗauka. Canjin ya shafi interface ɗin, don haka yana aiki yayin da tunnel ɗin yake sama, kuma ya dace a cikin script kusa da abokin ciniki maimakon a cikin shell da za ka manta. Ba zai iya ba da shiga lokaci ɗaya ga adireshi ɗaya a cibiyoyin sadarwa biyu ba, kuma wannan iyaka ce ke tura kowa zuwa ƙasan teburin.

Sake lambobin LAN na gida zuwa 10.10.0.0/24 shine gyara mai tsabta: sabunta lamunin DHCP ɗaya tare da ajiyar wuri, jerin printer da adiresoshin da aka rubuta da hannu waɗanda ke ambaton tsohon kewayon. Sake lambobin ɓangaren ofis yawanci ba shawararka ba ce. IPv6 yana kawar da karo gaba ɗaya idan cibiyoyin biyu suna ɗauke da shi, ta amfani da prefix na gida na musamman daga fd00::/8 maimakon wani abu mai sauƙin tunawa, amma gwada aikace-aikacen ta TCP, ba da ping ba, domin ICMP na iya aiki yayin da sabis ɗin ba ya aiki.

Zaɓin fassarar OpenVPN da kansa shine makoma ta ƙarshe, ana tura shi daga uwar garken zuwa wani shigarwar directory na musamman ga abokin ciniki. Yana ɗaukar sigogi huɗu bayan sunan zaɓin — alkibla, cibiyar sadarwa, netmask da laƙabi — kuma laƙabin ba na zaɓi ba ne: push "route 192.168.2.0 255.255.255.0" da push "client-nat dnat 192.168.2.0 255.255.255.0 192.168.1.0". Cibiyar sadarwa da netmask sune kewayon da abokin ciniki yake gani (192.168.2.0/24), laƙabin shine ainihin kewayon ofis a ɓangaren uwar garken (192.168.1.0/24), kuma hanyar da aka tura ita ce ke sa wannan kewayon da ake gani ya zama abin isa. Sannan ofis ɗin yana bayyana ga wannan abokin ciniki ƙarƙashin 192.168.2.x. Rubuta taswirar a cikin profile ɗin, in ba haka ba na gaba zai yi mata debug a matsayin kuskuren hanya.

Buga sabis ɗaya kawai shine ƙuntataccen sigar fassara, kuma ba ya buƙatar zaɓin OpenVPN kwata-kwata. Dokar DNAT a kan host ɗin VPN tana sake buga tashar jiragen ruwa ɗaya, don haka LAN tana riƙe da adireshinta kuma ta isa sabis ɗin a adireshin host ɗin da ta riga ta sani. Kuɗin shine na yau da kullum: sabis ɗin yana ganin host ɗin VPN a matsayin tushe, don haka log ɗin kowane abokin ciniki da bincike na baya sun daina nufin komai. Wannan yana rufe jerin printer ɗaya ko shafin gudanarwa ɗaya, ba host ɗin ɓangarorin biyu da ke isa juna ba.

Abin da har yanzu ba zai yi aiki ba, da abin da za a rubuta

Broadcast ba ya wucewa ta tunnel ɗin da aka yi masa hanya. DLNA, UPnP, binciken NetBIOS da Wake-on-LAN sun dogara da broadcast ko multicast wanda na'urar tun ba ta ɗauka, don haka babu hanyar da za ta gyara ganowa. Haɗawa da dev tap yana faɗaɗa ɓangaren, tare da broadcast ɗin DHCP, ARP da kowace fakitin ganowa; fi son hanyar host unicast kamar route 192.168.2.1 255.255.255.255 don adireshin ɓangaren LAN na router mai nisa.

Router biyu da dukansu ke amfani da 192.168.1.1 a hanya ɗaya suna cikin iyali ɗaya na matsala: adireshin gida koyaushe yana yin nasara, don haka shafin router ɗin nesa ya kasance ba a iya isa ba har sai wata LAN ta ƙaura. Ƙara adaftan na biyu ba ya canza kome a kowane ɗayan ɗayan.

Rubuta shaidar kafin ka gyara wani abu: ip route get ko Find-NetRoute, ping -c 3 zuwa adireshin da ake magana akai, traceroute, da tcpdump -ni tun0 icmp a kan abokin ciniki, sannan teburin hanya da na'urorin NAT a kan uwar garken. Ping ɗin da ke aiki gefe ɗaya kuma ya mutu a ɗayan yana nuna hanyar dawowa, ba tunnel ba, kuma wannan bambanci ɗaya ne ke yanke shawarar wane gyare-gyaren da ke sama kake buƙata da gaske.