Me ya sa sabar VPN da ke bayan CGNAT ba ta taɓa karɓar haɗi

Rawuta tana ba da adireshin WAN wanda ke farawa da 100.72, sunan DNS mai motsi yana warwarewa zuwa wani adireshin jama'a, kuma sabar VPN da ke kan wannan rawuta ba ta taɓa kammala musabaha daga waje ba. An saita tura tashar jiragen ruwa, sabis ɗin yana aiki, kuma gwaji daga LAN yana aiki har yanzu. Babu abin da ke cikin tarihin rawuta da ya yi kama da kuskure. Wannan haɗewar NAT ce ta matakin mai ɗaukar sadarwa, kuma babu wata ka'idar wutar bango da za ta buɗe tasha a adireshin da ISP ke riƙe.

Tabbatar da adireshin da aka raba yana ɗaukar minti biyu kuma yana hana makonni na canje-canjen saiti.

Alamun da ke nuna NAT na mai ɗaukar sadarwa

Kwatanta adireshin WAN a shafin matsayi na rawuta da adireshin da bincike na waje ya bayar. Adireshin WAN cikin 100.64.0.0/10 shine alamar da aka saba, kuma yankunan sirri 10/8, 172.16/12 da 192.168/16 suna nufin abu ɗaya. Idan traceroute ya nuna tsallen jama'a ɗaya ana maimaitawa, ko wani tsalle na farko ya amsa da adireshin sirri, wani mai fassara yana tsakanin rawuta da intanet. Wasu ISP suna jera adireshin da aka ba su kawai a tashar abokin ciniki, don haka fitar da wannan ƙimar tare da traceroute.

Canza ka'idoji ko tashoshi ba ya taimakawa, domin matsalar ita ce isa ga shigowa ba tasha da aka rufe ba.

Me ya sa turawa da DNS mai motsi ba za su iya gyara shi ba

Ka'idar tura tasha tana daidaita tasha a fuskar WAN na rawuta, amma zirga-zirgar shigowa ba ta taɓa isa wannan fuskar: ISP yana fassara shi da farko kuma yana tura abin da teburinsa ya yarda kawai. Wallafa adireshin da aka raba a DNS mai motsi yana jagorantar abokan ciniki zuwa ƙofar ISP da masu biyan kuɗi da yawa ke amfani da ita, shi ya sa sunan ke warwarewa kuma musabahar ke ci gaba da gazawa. Gwaje-gwajen hairpin suna yin nasara domin rawuta tana amsa ka'idarta daga ciki, kuma UPnP tana da makaho iri ɗaya.

Sake saita abokin ciniki shi ma ba zai taimaka ba, domin gazawar tana faruwa kafin a karanta duk wani saitin abokin ciniki.

Tura ta VPS tare da hanyoyi bayyananne

Sanya adireshin jama'a a gaba ta hayar mafi ƙarancin VPS da zai iya ɗaukar zirga-zirgar, sannan ka sa rawutar gida ta buga waya zuwa gare shi. UDP na fita daga cibiyar gida yana wuce NAT na mai ɗaukar sadarwa, don haka tunnel ɗin yana kafuwa daga ciki kuma VPS ɗin ya zama ƙarshen da ake iya isa. Gefen gida ya zama abokin ciniki da tsayayyen adireshin tunnel, ba sabar ba.

A kan VPS, ƙara shigarwar jagorar da ta shafi abokin ciniki domin sabar ta san wane abokin aiki ne ya mallaki ƙaramin cibiyar gida, sannan ƙara hanyar kernel da ta dace.

# /etc/openvpn/server/ccd/home-site.conf
ifconfig-push 10.8.0.10 255.255.255.0
iroute 192.168.50.0 255.255.255.0

# server.conf
client-config-dir /etc/openvpn/server/ccd
route 192.168.50.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"

Layin iroute yana gaya wa OpenVPN wane abokin ciniki ke karɓar zirga-zirgar ƙaramin cibiyar gida; layin route yana sanya wannan ƙaramin cibiyar a cikin teburin kernel na VPS domin fakiti su shiga tunnel ɗin kwata-kwata. Don sabis da aka wallafa, ƙara ka'idar NAT ta manufa da ke tura tashar jama'a zuwa 10.8.0.10 kuma kunna net.ipv4.ip_forward.

Gwada hanyar daga waje

Tabbatar da kowane tsalle a gefen jama'a, domin tunnel mai nasara ba ya tabbatar da cewa ana iya isa sabis ɗin. Matsayin sauraro da kama fakiti a kan VPS suna raba 'babu abin da ya iso' da 'ya iso kuma an jefar da shi'.

ss -lunp | grep 1194
tcpdump -ni any udp port 1194
nft list ruleset | grep -A4 dnat

# from a phone on mobile data, not the home Wi-Fi
nc -vz -u 203.0.113.10 1194

Idan kamawar ta nuna fakiti daga wayar amma babu amsa, wuri na gaba shine saitin sabar ko wutar bango. Idan kamawar ba ta nuna komai ba, abokin ciniki yana warwarewa ko aika zuwa adireshin da bai dace ba.

Wasu zaɓuɓɓuka da ya kamata a fara lissafa farashinsu

Adireshin IPv4 na musamman daga ISP shine mafi gajeriyar magani kuma yawanci ƙaramin kuɗin wata ne. IPv6 na asali yana kawar da fassara a ɓangarorin biyu lokacin da VPN, cibiyar abokin ciniki da rikodin DNS duk suna ɗaukar sa. Murfin mesh tare da rawutar ƙaramin cibiyar a cikin cibiyar gida yana samun wannan turawa ba tare da VPS ba, amma da farashin dogaro da sabis ɗin daidaitawa.

Zaɓi turawa lokacin da buƙatar ita ce tsayayyen isa ga shigowa kuma kowane ka'ida ya kamata ya kasance ƙarƙashin ikonka. Zaɓi adireshin ISP lokacin da kasafin kuɗi ya yarda kuma manufar ita ce kawai ka daina tunani a kai.