Ku dar VPN goobta dhinaca router-ka ISP adigoon jarjarin wicitaannada

Inta badan goobaha yaryar waxay hore u leeyihiin hal sanduuq oo qabta internetka, DHCP iyo khadka codka, sanduuqaasina ma wado tunnel-ka goobtaada. Ku darista gateway labaad waddada gaarka ah way shaqaysaa haddii aad go’aansato yaa leh waddo kasta ka hor intaadan taaban fiilo. Khatarta dhabta ah maaha tunnel-ka; waa in si aamusnaan ah loo beddelo qalabka telefoonnada diiwaangashan haysta. Samee shantan hubin si isku xigta oo joog halka mid ku guuldareysto.

Qor doorkaha hore u shaqeeya

Diiwaangeli gateway-ga caadiga ah, server-ka DHCP, xalliyaha magacyada iyo qalabka haysta diiwaangelinta codka ee bixiyaha. Tusaalahan router-ka ISP waa 10.50.0.1, gateway-ga cusub wuxuu noqon doonaa 10.50.0.2, goobta fogna waa 10.60.0.0/24. Waxba qorshahaas kama beddelo saddexda door ee ugu horreeya, taasna waa ujeeddada. Kadib xaqiiji in sanduuqa labaad uu runtii dhammayn karo tunnel-ka: eeg borotokoolka, xawaaraha la filayo iyo haddii uu helo cusboonaysiinta firmware ama baakadaha. Qalab leh calaamad VPN oo aan lahayn waddo cusboonaysiineed waa culays, maaha kordhin.

Haddii aadan sheegi karin yaa leh adeegga codka, joog. Beddelka router-ka leh diiwaangelin la’an qorshe dib u noqosho wuxuu mashruuca VPN u beddelaa jajab telefoon.

Siin gateway-ga cusub hal cinwaan iyo hal shaqo

Kaydi cinwaankiisa LAN meel ka baxsan barkada DHCP si uusan u dhaqaaqin dib u bilaabista kadib, hana siin waddo caadi ah oo u gaar ah haddii aadan rabin inuu noqdo waddo internet. Shaqadiisu waa inuu hayo tunnel-ka oo ka jawaabo prefisyada fog. Ku saabsan martigeliyayaasha LAN ee ay tahay inay gaaraan goobta fog, caddee waddada ay hadda qaataan iyo tan aad rabto beddelka kadib; labada amar ee isku mid ah ka hor iyo ka dib waa caddaynta ugu jaban.

ip route get 10.60.0.55
ip neigh show 10.50.0.2
traceroute -n 10.60.0.55

Haddii raadinta ay soo celiso router-ka ISP oo traceroute ku dhinto cidhifka internetka, martigeliyaha wali ma laha waddo fog, taas oo la filayay. Haddii ay soo celiso wax aan la filayn, marka hore xalli taas, maxaa yeelay tallaabo kasta oo xigta waxay u qaadataa saldhiggan.

Dooro yaa leh waddada prefix-ka fog

Xulashada A waa router-ka ISP: wuxuu hayaa waddo joogto ah oo loogu talagalay 10.60.0.0/24 oo u jeedda gateway-ga, martigeliyah kastana wuxuu raacaa gateway-kiisa caadiga ah sidii hore. Xulashada B waa martigeliyah kasta: kaliya mishiinnada u baahan goobta fog ayaa hela waddo cad oo maraysa 10.50.0.2, wixii kale oo dhan waxay ahaanayaan mid aan la taaban. A waa nadiif badan martigeliyayaal badan, laakiin badanaa waxay u baahan tahay in router-ka bixiyaha uu aqbalo waddo joogto ah, taas oo qaar aanay samayn. B uma baahna iskaashi bixiye, laakiin waxay kuu reebaysaa dayactirka habaynta martigeliyayaasha, marka waxay ku habboon tahay koox yar oo mishiinno la ansixiyay.

Labada xaaladoodba jihada dib u soo noqodka waa inay jirtaa. Haddii jawaab fog ay timaaddo gateway-ga oo gateway-ku si toos ah ugu gudbiyo martigeliyah LAN, taraafikadu waxay dhaaftaa xaaladda firewall ee router-ka ISP ku hayay waddada bixitaanka. Marka gateway-ku aanu ahayn router-ka caadiga ah ee LAN, isku dheelitir la’aantaas waa go@APOS;aan naqshadeed, maaha khalad la iska indhatiri karo.

ip route add 10.60.0.0/24 via 10.50.0.2 dev eth0
ip route get 10.60.0.55 from 10.50.0.77

Ka dhig gelitaanka mid joogto ah iyada oo loo marayo milkiilaha habaynta martigeliyaha, maaha iyada oo loo marayo qoraal gelitaan. Waddo kaliya jirta kadib markii qof galo ayaa ku guuldareysan doonta marka ugu horreysa ee mishiinku dib u bilaabo sabab aan xiriir la lahayn.

Diyaari barta gelitaanka ah ee la gaari karo

Gateway-ga wuxuu u baahan yahay cinwaan ay goobta fog gaari karto. Gadaasha router-ka ISP taas macnaheedu waa gudbinta port ama gelitaan DMZ, labadaba waxay ku xiran yihiin in bixiyuhu runtii keeno taraafikada. Gudbin maxalli ah kama gudbi karto NAT heerka shirkadda dhinaca bixiyaha. Haddii bixiyuhu aanu siin barta la gaari karo, rog jihada: u oggolow labada goob inay ka bilaabaan xarun aad maamusho. Taasi waa naqshad ansax ah, laakiin waxay ku daraysaa ku tiirsanaanta saddexaad ee gudbinta, kalsoonida iyo helitaanka, DNS firfircoonna ma beddelo taas.

Xaqiiji gudbinta iyada oo lagu qabanayo gateway-ga, maaha websayt scan-gareeya port-yada. Scan-yada waxay sheegaan port-ka inuu xiran yahay ilaa dhageystaha la xiro, gudbin aan marnaba keenin taraafikadana dibadda waxay u eg tahay sida port xiran.

Aqbal adeegga gaarka ah iyo khadka codka wada

Tijaabo hawsha loogu talagalay martigeliyah LAN, iyada oo la isticmaalayo DNS gaar ah iyo aqoonsiga abka laftiisa. Tunnel waddo leh kama dhigto baaritaanka fog mid u eg qaybta Ethernet maxalliga ah, marka helista iyo xallinta magacyadu waxay u baahan yihiin habayn u gaar ah.

curl -sS -o /dev/null -w '%{http_code}\n' https://files.example.net
ping -c 3 10.60.0.55

Kadib xaqiiji in gelitaanka internetka caadiga ah uu wali ka shaqeeyo isla martigeliyahas oo telefoonnadu wali diiwaangashan yihiin; labada hubin waxay qabtaan isbeddel shil ah oo ku yimaadda waddada caadiga ah, taas oo ah habka ugu caansan ee mashruucan u jebiyo wax uusan waligiis dooneyn inuu taabto. Ku dhammee qoraal soo kabasho oo qoran: qalabkee ayaa haysta doorkee, cinwaannada kaydsan, iyo sida waddada prefix-ka fog looga saaro hal tallaabo. Waddo gaar ah oo si nadiif ah dib loo qaadan karo ayaa ka qiimo badan mid maanta kaliya shaqeeya.