Ku darista shabakad hoosaad labaad VPN ga u dhexeeya goobaha: laba waddo
Tunnellada ku salaysan siyaasadda waxay u baahan yihiin xulayaal iswaafajisan labada dhinac; kuwa ku salaysan waddada waxay u baahan yihiin waddo. Dooro waddada saxda ah oo marka hore hagaaji waddada soo noqodka.
Ku darista shabakad hoosaad labaad tunnell shaqaynaya oo u dhexeeya goobo waxay qaadataa shan daqiiqo hal naqshad iyo ku dhowaad galab dhan tan kale. Marka tunnellku waddooyin u rakibo horudhacyada aad sheegto, waxaad ku dartsaa waddo oo taraafikku raacaa. Marka uu ka wada hadlo hal lammaane xulayaal ah oo goan, horudhaca cusub wuxuu ahaanayaa mid aan la ilaalin ilaa labada dhinac ay ku heshiiyaan lammaane iswaafajisan. Saddex arrimood ayaa goaamiya: waxa ay habaynta dhinac kasta run ahaantii qeexayso, haddii taraafikku ku yaraado lammaanaha ugu yar ee iswaafajisan, iyo yaa leh waddada soo noqodka ee xadka cusub.
Akhri kernel ka, ma aha calaamadda xaaladda
Tunnell sheegta isku xirnaan wuxuu rakibay ugu yaraan hal ururin ilmo, laakiin ma aha midka aad u malaynayso. Linux kernel ku wuxuu muujinayaa waxa la dabaqayo: ip xfrm policy wuxuu taxaa lammaanayaasha xulayaasha, swanctl --list-sas (ama ipsec statusall hore) wuxuu muujinayaa waxa labada dhinac ku heshiiyeen, oo ay ku jiraan xulayaasha taraafikada jiho kasta. Haddii horudhaca cusub aanu ku jirin labadaba, waa mid aan la ilaalin, wax kasta oo faylka habaynta sheego.
Isbarbardhig shaxda waddooyinka. Habaynta ku salaysan waddada, qalabka tunnellku waa tallaabada xigta ee horudhacyada la ilaaliyay. Habaynta ku salaysan siyaasadda inta badan ma laha waddo gaar ah oo loogu talagalay shabakadda fog, kaliya waddada caadiga ah, sababtoo ah siyaasaddu waa tan doorata taraafikada ee ma aha shaxda.
Ku salaysan siyaasadda: labada dhinac waa inay taxaan horudhaca cusub
Marka la eego ereyada strongSwan xulayuhu wuxuu ku nool yahay local_ts iyo remote_ts gudaha habaynta ilmaha, oo ah beddelka leftsubnet iyo rightsubnet. Horudhaca cusub waa inuu ka muuqdaa labada dhinac si muraayad ah: waxa goobta A ugu yeedho gudaha, goobta B waxay ugu yeedhaa fog. Is waafajin la aan marar dhif ah ayay khalad nadiif ah bixisaa. Labada dhinac way isku soo ururaan ilaa isgoyska, horudhaca hore wuu shaqeeyaa oo kaliya kan cusub ayaa si aamusan u guuldareysta.
swanctl --load-conns
swanctl --initiate --child <child-name>
swanctl --list-sas
ip xfrm policypfSense ama OPNsense taas macnaheedu waa gelitaan Phase 2 labaad oo isku xira shabakadda gudaha cusub iyo tan fog cusub, ka dibna codsasho. Hayso gelitaanka hore; beddelkiisu wuxuu rarayaa shabakadda asalka ah halkii uu ku dari lahaa. Haddii Phase 2 jira uu horey u daboolo shabakad weyn sida 0.0.0.0/0 ama xad kooban, ha ku darin gelitaan cidhiidhi ah dhinaceeda: xulayaasha is dulsaaran waxay rakibaan siyaasado tartamaya oo nidaamka qiimayntu wuxuu goaamiyaa guulaystaha.
IKEv1 wuxuu lammaane kasta oo shabakad hoosaad ka dhigaa Phase 2 u gaar ah, dhinacna qaata hal lammaane kasta oo is dhaafsi wuxuu tuuraa inta kale. IKEv2 waxa uu qaadi karaa dhowr lammaane xulayaal ah hal ilmo, laakiin kaliya haddii labada hirgelin ay aqbalaan. Liiska ka yimid swanctl --list-sas waa runta; waxa aad qortay waa codsi.
Ku salaysan waddada: waddadu waa siyaasadda
Interface XFRM ama qalab VTI wuxuu taraafikada qaadaa sida shaxda waddooyinku qabto. Waxaad horudhaca cusub u jeedisaa qalabka labada goobood, oo xaaladda ku xiran beddelka interface ka ayaa lagu dabaqaa. Ma jiro lammaane xulayaal ah oo la isku duwo, taas ayaa sababta naqshaddani u sii fidisaa si fiican marka shabakadaha hoosaadku badan yimaadaan. Hagaha gudbinta strongSwan wuxuu si faahfaahsan uga hadlaa dhinaca kernel ka.
ip route add 192.168.60.0/24 dev xfrm0
ip route get 192.168.60.10WireGuard aad buu u sii socdaa. AllowedIPs waa liiska fasaxa kripto isla markaana, iyada oo loo marayo wg-quick, gelitaanka shaxda waddooyinka. Ku dar horudhaca hal dhinac oo kaliya waxaad helaysaa is gacan qaad, baakado baxaya iyo aamusnaan, sababtoo ah dhinaca fog wuxuu tuuraa baakadaha aan isha laga helin liiskiisa. Qaabka wg set wuxuu beddelaa liiska oo dhan, marka ku celi horudhacyadii hore u shaqeeyay ama waad gooyn doontaa:
wg set wg0 peer <PUBKEY> allowed-ips 192.168.10.0/24,192.168.60.0/24
ip route add 192.168.60.0/24 dev wg0Amarka labaad ma aha ikhtiyaari marka aad isticmaashay wg set halkii wg-quick. Kernel ku isla markiiba wuu aqbalaa liiska cusub, laakiin waxba waddo uguma daro, marka taraafikada gudaha laga abuuray wali waxay ka baxdaa albaabka caadiga ah. Tani waa sababta ugu badan ee shabakad hoosaadka WireGuard cusub uga shaqeeyo martigeliyaha tunnellka ee aan laga shaqayn kumbuyuutar.
Waddada soo noqodku waxay ka sii guuldareysataa tunnellka
Martigeliyayaasha shabakadda fog cusub waa inay jawaabaha ku celiyaan albaabka VPN. Marka albaabkaasi aanu ahayn router kooda caadiga ah, jawaabtu waxay u tagtaa router ka LAN, kaas oo tuuraya ama u gudbiya internet ka ciwaan isha gaar ah. Tijaabi martigeliyaha dhinaca fog, ma aha albaabka: ip route get 10.30.20.15 Linux ama Find-NetRoute -RemoteIPAddress 10.30.20.15 PowerShell wuxuu muujinayaa tallaabada xigta ee martigeliyuhu runtii isticmaalayo. Haddii jawaabtu aanay ahayn barta ugu dambeysa ee tunnellka, ku dar waddo joogto ah horudhaca cusub halkaas.
NAT ka isha ee goobta aan lahayn waddada soo noqodka waa beddel sharci ah iyo habka ay qaar badan oo hub and spoke ah uga fogaadaan taabashada server kasta. Ku dabaq sidoo kale horudhaca cusub albaabka dhinaca goobta loo socdo:
iptables -t nat -A POSTROUTING -s 10.30.20.0/24 -d 192.168.60.0/24 -j MASQUERADEQiimuhu waa dhab. Diiwaannada fog waxay joojinayaan muujinta ciwaannada isha ee gaarka ah, oo xeerarka derbiga dabka ee ku salaysan shabakadda asalka ah waxay ku biiraan hal xeer oo albaabka ah. Tan si ula kac ah u dooro, ma aha sababtoo ah waddo ayaa maqan.
Derbiyada dabka waa qaybta kale ee waddada soo noqodka. Qalabka ku salaysan aagaggu si otomaatig ah uguma fidyaan aagga interface tunnell jira shabakad hoosaad cusub, oo xeerka loo qoray horudhaca hore ma iswaafajin doono. Ku dar shabakadda cusub aagga ama lammaanaha xeerarka labada jiho kahor intaadan IPsec eedayn.
Goaanso saddex su aalood, ka dibna ku xaqiiji taraafik
Qaabka gaaban: habaynta dhinacu ma sheegtaa horudhacyo (ku salaysan siyaasad), mise taraafikku wuxuu u socdaa interface (ku salaysan waddo)? Labada daraf ma taxaan horudhaca cusub? Ma jiraa waddo ku soo noqota shabakadda cusub ilaa xadka isha asalka ah?
| Tunnel style | Where the prefix goes | What breaks if you skip it |
|---|---|---|
| Policy-based IPsec | Selector pair on both peers | Old subnets work, the new one fails with no clear error |
| Route-based XFRM or VTI | Route into the device on both sites | Packets routed but not transformed, or the state never matches |
| WireGuard | AllowedIPs on both peers plus a route | Handshake succeeds, replies are dropped |
| Overlapping supernet | Adjust the existing entry instead | A shadowed policy wins or loses by evaluation order |
Xaqiijintu waa goobta ay inta badan isbeddelladu aad u hor maraan. Ping ka albaabka wax yar buu caddeeyaa, sababtoo ah albaabku isaga ayaa ka dira oo inta badan wuxuu la kulmaa siyaasad ka duwan tan martigeliyaha. Ping martigeliyaha shabakadda cusub, ka dibna socodsii barnaamijka isbeddelka keenay, oo eeg tirakoobka ee ma aha calaamadda xaaladda.
tcpdump -ni any host 192.168.60.10 and (esp or udp port 4500)
ip xfrm state
wg showTunnell ku salaysan siyaasadda tirakoobka ip xfrm state waa inuu labada jiho kor u kaco; tirakoob siman waxay ka dhigan tahay baakadka waa la waday laakiin lama dooran. WireGuard wg show wuxuu soo sheegaa gudbinta dhinac kasta, is gacan qaadka eber byte la helayna wuxuu tilmaamayaa liiska dhinaca fog ama waddada soo noqodkiisa.
Ku dhammee inaad diiwaangeliso horudhaca, xulaha ama waddada dhinaca, go aanka waddada soo noqodka iyo gelitaanka derbiga dabka oo ay la socdaan inta kale ee liiska tunnellka. Ka dib dib u bilaab hal albaab oo mar kale tijaabi: waddo gacanta lagu daray wuu lumaa, oo qofka xiga ma aha inuu mar kale ogaado.