Inda NAT na VPN yake a cikin before.rules na UFW da yadda ake gwada shi

Dokar NAT da ke aiki idan an buga ta a cikin shell tana gazawa idan an liƙa ta cikin before.rules, domin wannan fayil ɗin ba script ba ne. Takardu ne mai tsarin mayarwa da sassan tebur, bayanan sarƙa da alamar COMMIT ga kowane tebur. Layi a wurin da bai dace ba ko dai ya dakatar da duk mayarwar ko kuma ya watsar da dokokin da ka yi imanin suna nan. Jagorar da ke ƙasa tana sanya guntun a inda tsarin yake tsammani kuma tana tabbatar da sakamakon kafin sake lodawa na gaba.

Umarnin shell ba fayil ɗin mayarwa ba ne

Layin da ya fara da iptables -t nat umarni ne ga binary na iptables, yayin da fayil ɗin da UFW ke karantawa bayanin cikakken saitin dokoki ne. Bambancin ba na kwalliya ba ne: tsarin mayarwa dole ne ya san a wace tebur yake, waɗanne sarƙoƙi suke akwai da kuma inda tebur ɗin ya ƙare. Umarnin da aka liƙa cikin wannan takardar ko kuskuren rubutu ne ko kuma, mafi muni, doka da aka haɗa da tebur mara kyau. Tsarin yana loda waɗannan fayiloli ta kayan aikin mayarwa domin suna bayyanawa ne ba jeri ba.

Ana kuma loda takardar gaba ɗaya, don haka ɓataccen sashe ɗaya na iya hana sauran fayil ɗin yin aiki. Don haka ƙaramin kuskure a cikin guntun NAT yana jawo dokokin tacewa ƙasa tare da shi, kuma haka canjin firewall ya zama tsayawa.

Sanya guntun cikin sashin tebur da ke akwai

Guntun NAT yana da siffa, kuma siffar ta fi muhimmanci fiye da rubutun dokar da ke cikinsa. Kan tebur yana buɗe sashin, bayanan sarƙa suna kafa ma'auni, dokokin suna biyo baya, kuma COMMIT yana rufe sashin.

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.55.0.0/24 -o ens3 -j MASQUERADE
COMMIT

Tafkin da haɗin da ke sama masu riƙe wuri ne don naka; tsarin shine ɓangaren da ya cancanci kwafi. Idan fayil ɗin ya riga ya ƙunshi sashin *nat, ƙara dokar cikin wannan sashin maimakon buɗe na biyu, domin tsarin yana tsammanin COMMIT ɗaya ga kowane tebur kuma sassan biyu ga tebur ɗaya gyara ne da ke jiran faruwa. Ka kiyaye bayanan sarƙar rarrabawa gaba ɗaya, gami da duk wanda mai siyar ya ƙara don haɗin kansa. Littafin tsarin UFW yana rubuta fayilolin before, user da after tare da buƙatar COMMIT mai dacewa.

Idan fayil ɗin ya zama babu komai, kada ka cika shi daga koyarwa. Tabbatar da wane fakiti ya mallake shi da menene manufar rayuwa a zahiri, domin fayil ɗin dindindin mara komai baya tabbatar da cewa kernel ba shi da dokoki, kuma saitin dokokin da aka loda baya tabbatar da cewa sake lodawa na gaba zai sami cikakken fayil don karantawa. Fara mayar da tushen da aka tallafa sannan ka sake aiwatar da canje-canjen wurin a kansa.

Gwada ɗan takarar ba tare da aiwatar da shi ba

Kayan aikin mayarwa na iya bincika da gina saitin dokoki ba tare da aiwatar da shi ba, wanda shine mafi arha gwajin da ake da shi. Ka gudanar da shi akan kwafin da aka kare ba akan fayil ɗin rayuwa ba, kuma ka karanta rubutun kuskure ba kawai matsayin fita ba. Rashin bincike yana ambaton layi kuma yawanci tebur, wanda ya fi abin da sake lodawa da ya gaza zai gaya maka.

sudo cp /etc/ufw/before.rules /root/before.rules.bak
sudo iptables-restore --test < /root/before.rules.bak
echo "exit: 0"

Cin wannan gwajin yana tabbatar da cewa ana bincika takardar kuma ba wani abu ba. Baya tabbatar da cewa ɗan takarar har yanzu yana ɗauke da kowane sarƙa da UFW ya dogara da shi, cewa yana ba da izini kawai ga tushen da ka nufa, ko cewa sarrafa nesa ya kasance ana iya isa gare shi. Waɗannan bita ne daban, kuma na ƙarshe ya cancanci zama na biyu da aka buɗe kafin ka fara.

Zaɓi kayan aikin da ya dace da backend ɗin da aka shigar da dangin adireshi. Mai masaukin da ke gudanar da backend ɗin nft ta hanyar layin jituwa yana buƙatar umarnin da ya dace, kuma dokokin IPv6 suna zaune a wani fayil daban.

Raba turawa, NAT da manufar shiga

Fassarar tushe tana magance matsalar adireshi kuma ba ta ba da komai. Turawa wata izini ce daban da sysctl da teburin tacewa ke sarrafawa, kuma ita ce mutane ke mantawa lokacin da rami yake bin hanya amma baya wucewa da zirga-zirga. Manufar shiga ita ce shawara ta uku game da wace tushe za ta iya isa waɗanne ayyuka, kuma babu dokar NAT da ke bayyana ta. Raba ukun shine abin da ke sa gazawa a iya tantancewa maimakon wata alama mara tabbas.

sysctl net.ipv4.ip_forward
sudo iptables -t nat -S POSTROUTING
sudo iptables -S FORWARD

Karanta waɗannan fitarwa uku tare ba ɗaya bayan ɗaya ba. Dokar masquerade da turawa a kashe tana haifar da abokin ciniki da ke haɗawa kuma bai isa kome ba, wanda daga gefen abokin ciniki yake kama da kuskuren hanya kuma yana tura mutane zuwa fayil mara kyau. Teburin tacewa kuma shine inda accept mai faɗi da yawa ke ɓoyewa, don haka duba manufarta ta asali yayin da kake wurin.

Tabbatar da sake lodawa, ƙi da asarar VPN

Abubuwan lura uku suna yin cikakken gwajin karɓa: sake lodawa yana nasara, aikin abokin ciniki da aka yarda yana aiki, kuma buƙatar da ya kamata a ƙi ana ƙi ta da gaske. Na uku shine wanda ake tsallake, kuma shine kawai hujja cewa manufar tana yin wani abu.

sudo ufw reload
sudo ufw status verbose
sudo iptables -t nat -L POSTROUTING -n -v

Sannan gwada gazawar da ka tsara. Sauke ramin ka kalli abin da mai masaukin yake yi, domin manufar da ke aiki kawai yayin da VPN ke kunne manufa ce da dogaro da ba a bayyana ba. Sake lodawa sau ɗaya kuma bayan haka don tabbatar da cewa fayil ɗin, ba wani ragowar yanayin gudana ba, ke samar da sakamakon da ke aiki.

IPv4 NAT baya faɗin komai game da IPv6, don haka bayyana ɗaukar hoto da aka yi niyya ga duka dangin biyu a cikin wannan bayanin da dokar. Manufar ita ce ingantaccen tsarin da aka sarrafa, kuma guntun da ya samu bincike bisa kwatsam ba hujja ba ne a kansa.