Me ya sa NAT na gida ba ya kare mashigar VPN ɗinka
Na'urar sadarwa ta gida tana tura rami, amma mai masaukin ne ke yanke hukunci kan fakiti da aka buɗe. Karanta mai sauraro, hanyar ciki da manufar shiga daban.
Kwamfutocin hannu da ke bayan na'urar sadarwa ta gida ba tare da tura tashar ba har yanzu suna karɓar haɗin SSH da ke zuwa ta VPN. Wannan ba sabani ba ne, domin na'urori biyu daban-daban suna yanke hukunci kan fakiti biyu daban-daban. Na'urar sadarwa tana tura jigilar da aka ɓoye, kuma mai masaukin ne ke yanke shawarar abin da za a yi da fakiti da aka buɗe wanda ya isa mashigarsa ta rami. Raba waɗannan hukunci biyu shine duk aikin.
Na'urar sadarwa tana tura ramin, mai masauki yana yanke hukunci kan fakitin
Zana hanyar daga tushen nesa zuwa sabis kafin ka duba ko ɗaya doka. Bangaren waje shine jigilar VPN, wanda na'urar sadarwa da ƙofa ke gudanarwa. Bangaren ciki yana farawa lokacin da ƙarshen ke cire layin rami kuma mai masauki ya karɓi fakiti da aka aika zuwa adireshinsa na VPN.
Haɗa waɗannan bangarori biyu sai na'urar sadarwa ta sami yabo kan shawarar da mai masauki ya yanke. Shafin tura tashar ko tarihin na'urar sadarwa suna bayyana tattaunawar waje kawai, kuma babu ɗaya da ya ce wane irin zirga-zirgar da aka buɗe mai masauki zai karɓa. Mai masauki yana amfani da manufarsa ta shiga kan fakitin ciki, kamar yadda yake yi kan kowane fakiti da ya isa mashiga. A cikin wannan manufar ne ake warware tambayar fallasa da gaske.
Mai sauraron duniya ba sabis na jama'a bane
A Linux, ɗaurewa zuwa INADDR_ANY yana nufin kowane adireshin gida, don haka sabis na iya amsawa a mashigar rami da bai taɓa ambatawa ba. Bayanin soket na IP yana bayyana wannan ɗaurewar, kuma ya cancanci karantawa kafin ka yanke shawara daga jerin masu sauraro. Shigar duniya hujja ce game da soket, ba magana ba ce game da isarsuwa.
Layukan biyu da ke ƙasa sabis ɗaya ne a ɗaure biyu daban-daban, kuma bambancin shine duk amsar ko mashigar tana da muhimmanci. Karanta a wane adireshi soket ɗin yake kafin komai.
ss -lntp "sport = :22"
LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
LISTEN 0 4096 10.8.0.6:22 0.0.0.0:* users:(("sshd",pid=812,fd=4))Faɗi tsarin da zai iya isa tashar
Tsare-tsare uku suna sanya fakiti a wannan mashiga, kuma suna da masu shi daban-daban. Ambaton wanda ya dace shine ke yanke shawarar wanda zai canza manufa.
| Arrangement | What reaches the port | Where the decision lives |
|---|---|---|
| Another permitted VPN peer | A packet from the same tunnel subnet | Gateway forwarding policy and host input rules |
| A deliberate public forward | Traffic the gateway publishes on purpose | Gateway service definition |
| A subnet routed behind the gateway | Client traffic from the far side | Gateway route and host input rules |
Sakamakon burauza da ke nuna adireshin fita na jama'a ba ya faɗi komai game da ɗaya daga cikin ukun, domin yana bayyana yadda zirga-zirgar fita ke fita maimakon abin da aka yarda da zirga-zirgar shiga. Yi aiki a baya daga mai sauraro da adireshin tushe a cikin tarihin sabis. Idan tushen wani abokin rami ne, manufar ƙofa ita ce takardar mai ban sha'awa. Idan adireshi ne da aka fassara, nemo fassarar kafin ka canza doka.
Iyakance sabis ɗin zuwa hanyar da ka yi niyya
Idan ana bukatar SSH daga hanyar gudanarwa kawai, rubuta wannan hanyar a matsayin kewayon tushe da mashiga. Sannan iyakance dokokin shiga na mai masauki ta mashiga, manufa da tushe maimakon ta sunan cibiyar sadarwa, domin sunan da ya yi kama da na sirri na iya wakiltar kowane adireshi. Bar hanya ga wanda zai gyara matsala ta gaba.
nft add rule inet filter input iifname "tun0" ip saddr 10.8.0.0/24 tcp dport 22 accept
nft list chain inet filter inputDoka da ta ambaci mashigar rami da kewayon gudanarwa tana bayyana niyya a wuri ɗaya. Kwatanta ta da doka da aka rubuta don cibiyar sadarwar Wi-Fi, wadda ba ta faɗi komai game da zirga-zirgar rami da aka buɗe. Lokacin da layukan biyu ba su yarda ba, manufar mai masauki ita ce fakitin ke saduwa da ita.
Bar shiga da faci daidai inda suke; isa tashar bai taɓa zama ɗaya da samun izinin amfani da ita ba. Yi rikodin iyali adireshi da lokaci ga kowane tushen da ba a sani ba, kuma yi bincike kafin ka zargi wata siffa ko rauni. Doka da ke karɓar kowane abokin rami wani tsari ne daban da wanda ke karɓar ƙaramin cibiyar gudanarwa, kuma babu layin tarihi da zai faɗi wanda ake nufi.
Karɓi gyaran da nasara ɗaya da ƙi ɗaya
Tabbatar da bangarorin biyu: haɗi ɗaya da aka amince ya yi nasara kuma an ƙi hanyar da aka cire. Ƙin shine bangaren da mutane ke tsallakawa, kuma shine wanda ke nuna dokar tana aiki maimakon zama kusa da tsoho mai izini. Gwada daga gefen da aka cire maimakon yin tunani akai.
Maimaita biyun bayan sake haɗawa, domin ramin da ya dawo da wani sunan mashiga na iya wucewa da doka da aka iyakance ga tsohon a shiru. Iyakar da ke da muhimmanci ita ce wadda mai masauki ke amfani da ita kan fakiti da yake karɓa da gaske.