Me ya sa abokin ciniki na VPN a cibiyar ofis ke rasa kowace amsa

Kwamfutar tafi-da-gidanka tana zaune a /24 na ofis ta Ethernet kuma tana shiga uwar garken OpenVPN da ke zaune a cikin wannan /24. Abokin aiki yana yin ping ga adireshin ramin; buƙatar tana isowa sarai, kuma babu abin da ke komawa. Littafin rikodin ramin yana da tsabta kuma bincike yana aiki, don haka ramin shine wanda ba daidai ba. Tabbatar da tushen IPv4 a na'urar da ke karɓa yana jefar da fakitin kafin wani abu ya karanta shi.

Jefar tana faruwa kafin wani abu ya karanta fakitin

Tabbatar da tushe yana tambayar tambaya ɗaya game da kowane fakitin da ke shigowa: idan wannan mai masaukin ya amsa ga wannan tushen, shin amsar za ta fita ta hanyar da fakitin ya shigo da ita? Idan amsar ita ce a’a, kernel yana jefar da fakitin lokacin da ya iso. Babu soket ko hanyar tura da ke ganinsa har abada, shi ya sa rikodin da aka yi a ramin har yanzu yana rubuta buƙatar da manhajar ba ta taɓa samu ba.

Abokin ciniki a nan yana riƙe da 10.66.0.9 a raminsa, kuma uwar garken OpenVPN yana amsawa a 192.168.80.10 a cikin prefix na ofis. Abokin aiki a 192.168.80.25 yana ping ga adireshin ramin, don haka buƙatar ta ketare cibiyar, uwar garken ta tura shi cikin ramin, kuma yana isowa kan hanyar ramin abokin ciniki ɗauke da adireshin tushen ofis. A cikin teburin hanya na wannan na'ura, prefix na ofis na na'urar Ethernet ne, ba na ramin ba. Tabbatarwa tana kwatanta hanyar shigowa da hanya, ta sami rashin daidaituwa kuma ta watsar da fakitin, don haka abokin aikin yana ganin asara gaba ɗaya yayin da ɓangarorin biyu ke bayar da rahoton rami lafiyayye.

Hanyar madubi tana da wannan siffa: lokacin da abokin ciniki ya fara zuwa ofis, ana iya watsar da amsoshi a ɓangaren ofis saboda wannan dalili. Gyaran da aka tabbatar a hanya ɗaya kawai yawanci yana dawowa a matsayin tikit na biyu.

Tabbatar da yanayin da ke aiki kafin ka taɓa kowane sysctl

Karanta ƙimar da ke aiki maimakon dogaro da tsoho na rarraba, domin saitin kowace hanya rabin shawarar ne kawai. Yanayin da ke aiki shine mafi girma tsakanin ƙimar hanyar da ƙimar all, don haka sifili a hanyar ramin ba ya nufin komai muddin all ɗaya ne. Shawarar yanayin tsayayye shawara ce ta hanya, don haka gudanar da binciken da kernel ke gudanarwa kuma kwatanta amsarsa da hanyar da fakitin ya zo da gaske.

tcpdump -ni tun0 icmp and host 192.168.80.25
ip route get 192.168.80.25
sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.tun0.rp_filter

Sannan sake yin ping ɗin yayin kana kallon ma'aunin kuskure. Ƙididdigar da ke tashi kusa da buƙatar da rikodin ya riga ya nuna ita ce alamar wannan jefar, ba ta hanyar da ta ɓace ba. Kunna rikodin fakitin Mars yayin da kake wurin, domin kernel ya ambaci tushen da hanyar da ya ƙi. Tare suna cire sirri, katangar wuta da rasa iroute a matsayin bayani.

Rubuta layin tushe kafin ka canza wani abu: duka ƙimomin biyu, na'urar da binciken ya zaɓa, da ma'aunin da ka kalla. Wannan rikodin ne zai gaya maka daga baya ko canjin ya yi abin da kake tsammani.

Abin da kowane yanayin rp_filter ke karɓa da gaske

Kernel yana nuna ƙimomi uku ga kowace hanya, kuma ba inuwa uku na doka ɗaya ba ne. Sifili yana kashe binciken. Ɗaya yana da tsauri kuma yana buƙatar a tura tushen baya ta hanyar shigowa. Biyu yana sako-sako kuma yana buƙatar kawai akwai wata hanya zuwa tushen a cikin tebur, duk inda ta nufa.

Layin da ke da muhimmanci a nan shine sako-sako, da abin da yake ci gaba da ƙi. Tushen ƙarya wanda ake iya tura shi a ko'ina cikin teburinka yana wucewa, yayin da tushen da ba shi da wata hanya har yanzu ana ƙi shi. A kwamfutar tafi-da-gidanka wannan rangwame ne mai kunkuntar; a na'urar da ke tura zirga-zirgar wasu mutane yana da faɗi. Yanayin na mai masaukin ne, don haka wannan lambar ɗaya tana ɗauke da nauyi daban a wuraren biyu.

Wane layi wannan tsarin ke buƙata ya fito daga teburin ba daga al'ada ba. Fakitin halal ne kuma tushensa ana iya tura shi, don haka sako-sako yana karɓa kuma tsayayye ba ya karɓa. Babu wani abu a cikin lamarin da ke neman sifili, kuma zaɓin sifili zai cire binciken da ba ya kashe komai a nan.

Zaɓi mafi ƙarancin canji da ke cire ruɗani

Yanayin sako-sako shine mafi ƙarancin canjin da ya dace, kuma raguwa ce ta gaske a tsanani, ba maɓalli marar lahani ba. Akwai mafi kyawun zaɓi a duk lokacin da tsarin ya yarda: cire haɗuwar, kuma ruɗanin ya ɓace.

Inda ake buƙatar prefix ɗin ofis kawai ta Ethernet, cire shi daga hanyoyin da bayanin martabar ke ja, kuma adireshin zai zama mai isa ta hanya ɗaya. Lokacin da dole ne hanyoyin biyu su kasance tare da gaske, ɗaure tushen da na'urar da ƙa'idar manufa maimakon sassauta tabbatarwa a kowace hanya. Wannan yana riƙe da tacewa mai tsauri ga duk sauran abubuwa a na'urar kuma yana rubuta keɓancewar inda injiniyan na gaba zai neme ta.

Kowace hanya da ka zaɓa, rubuta ta a cikin sysctl drop-in ba a cikin umarni kai tsaye ba. Saita maɓallan all da default tare, domin sake haɗawa ba zai iya dawo da yanayin tsayayye a hankali ba.

# /etc/sysctl.d/99-rp-filter.conf
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
sysctl --system

Abin da yanayin sako-sako ke bari, da kuma inda

Yanayin sako-sako har yanzu yana ƙin tushen da babu wata hanya da za ta isa gare shi, kuma ya daina ƙin tushen ƙarya wanda ya kasance ana iya tura shi. A kwamfutar tafi-da-gidanka wannan rangwame ne mai kunkuntar. A na'urar da ke tura zirga-zirgar da ba nata ba, wannan zaɓi ɗaya ya fi faɗi sosai. Don haka saitin ɗaya yana ɗauke da ma'anoni biyu mabambanta sosai dangane da inda yake gudana.

Kashe binciken gaba ɗaya a mai masaukin da ke tura zirga-zirga domin wasu mutane shine kawai gyaran da ya kamata a guje. Sifili yana jefar da tabbatarwar da yanayin sako-sako ke riƙe da hankali. Idan mai masaukin yana tura domin wasu, yi jayayya da zaɓin ƙa'idar manufa daga sashin da ya gabata a maimakon haka.

Bar bayani wanda ya ambaci hanyoyin biyu, prefix ɗin da ke haɗuwa da ainihin gwajin da yanzu ke yin nasara. Wannan ya fi amfani ga injiniyan na gaba fiye da layin da ke cewa an daidaita tacewa.