VPN Pi leh isku-xidhayaal badan: dhig waddo kasta qalabka go'aanka gaaraya
Isku-xidh salka hoose ah wuxuu ku darayaa shabakad-hoosaad macmiil labaad, iyo mid kasta oo ka mid ah afarta qalab ayaa leh hal go'aan. Dhig waddooyinka, hubi isha, ka dibna ka tijaabi macmiil dhab ah.
Sanduuq Wi-Fi oo gadaasha Pi la dhigayaa wuxuu hal go'aan oo marsiir ah u beddelaa afar, qorshahuna wuu jabaa marka afarta oo dhan hal qalab lagu qaato. Su'aasha ugu horreysa ma aha waddo kee lagu daro. Waa haddii sanduuqa cusub uu buundo sameeyo ama uu maro, sababtoo ah jawaabtaas ayaa go'aamisa inta shabakad-hoosaad ay jiraan iyo qalabka ay tahay inay wax ka bartaan. Marka hore dooro qaabka isku-xirka; waddo kasta waxay ka timaaddaa isaga.
Buundo ama marsiir: doorashada go'aamisa tirada
Buundadu waxay macmiilka cusub dhigtaa isla shabakad-hoosaadka Pi horey u adeegto. Hal shabakad-hoosaad, hal awood DHCP, iyo wax is-dhaafin ah oo la maro ma jiro. Kani waa habka fudud iyo kan saxan marka shabakad macmiil oo gaar ah aan waligeed shardi ahayn. Xiriir la maro waa naqshad kale: sanduuqu wuxuu hayaa shabakad-hoosaadkiisa, oo hordhacaas waa in la qaado meel kasta oo taraafikadu tagto.
Qorshaha intiisa kale wuxuu hayaa isku-xidhka hoose oo ilaaliya cinwaannada isha macmiilka. Hadafku waa hal shabakad VPN oo gaar ah, ma aha bixitaan internet buuxa. Qor qaabka ka hor cinwaannada, sababtoo ah liiska hoose waa kaliya tusaale isku-xir la maro.
client subnet 10.41.0.0/24
client gateway 10.41.0.1
router-to-Pi link 192.168.71.2
Pi on that link 192.168.71.1
private target 10.72.9.0/24Yaa go'aama waxa
| Decision owner | Entry that encodes the decision | Failure when the entry is missing |
|---|---|---|
| Pi VPN host | Return route for 10.41.0.0/24 via 192.168.71.2, and a tunnel route for 10.72.9.0/24 | Replies to downstream clients die at the Pi |
| Owner of the remote network | A path for 10.41.0.0/24 over the permitted tunnel | Replies stop at the first unaware hop |
| LAN router behind the Pi | Specific route for 10.72.9.0/24 via 192.168.71.1, or a suitable default | Clients never send private traffic to the Pi |
| Client machine | Default via 10.41.0.1, or a specific entry for 10.72.9.0/24 | The private network is unreachable from the client |
Qalab kastaa wuxuu qaataa hal go'aan, mana jiro mid qaadi kara go'aanka mid kale isaga. Pi wuxuu u baahan yahay laba gelitaan, ma aha hal, oo waddada dib u noqodka waa tan dadku illoobaan. Taraafikada la gudbiyay si sax ah ayuu u gaaraa shabakadda gaarka ah ka dibna ku dhinta waddada dib u noqodka, sababtoo ah Pi ma oga halka 10.41.0.0/24 ku nool yahay. Taasi waxay u egtahay dhibaato derbiga dabka oo dhab ahaan waa waddo maqan.
Dhinaca fog sidoo kale wuxuu u baahan yahay waddo u gaar ah. Haddii adeegga cidhifka fog uusan ogeyn in 10.41.0.0/24 laga gaari karo tunnelladaada, jawaabuhu waxay joogsadaan boodhka ugu horreeya ee aan jawaab lahayn. Ku dar labada jiho ka hor inta aadan akhrin shaandhaynta baakadaha.
Boodhka xiga waxay ka yimaadaan isku-xirka
Boodhka xiga waa inuu noqdaa cinwaan ku yaal shabakad uu qalabku dhab ahaan gaari karo. Cinwaanka dadweynaha ee lammaanaha VPN ma aha boodhka xiga ee shabakad-hoosaad gaar ah, shabakadda adeegga fogna ma aha boodh xiga haba yaraatee. Waddo u socota irrid aan la gaari karin waxay liiska uga muuqataa sax oo tuurtaa baakad kasta. Hubi in irriddu jawaabto ka hor inta aadan eedeyn meesha loo socdo.
Hayso lammaanaha VPN ee dibadda ee Pi oo la gaari karo iyada oo loo marayo waddadiisa hoose. Gelitaankaas wuu ka duwan yahay waddooyinka xamuulka, isku darkooduna wuxuu bixiyaa tunnel aan dib u soo noolaan karin ka dib isbeddel waddo.
Dukumeentiga waddooyinka joogtada ah wuxuu caddeeyaa farqiga u dhexeeya meesha loo socdo iyo irridda, in kasta oo madal kastaa si kala duwan u magacaabo liisasheeda. Akhri dukumeentiga qalabka hortaada halkii aad koobi lahayd shaashadda iibiyaha kale. Amarrada hoose waxay muujinayaan qaabka gelitaannada Linux.
# on the Pi
ip route add 10.41.0.0/24 via 192.168.71.2
ip route add 10.72.9.0/24 dev tun0
# on the downstream router
ip route add 10.72.9.0/24 via 192.168.71.1Waxa tarjumaaddu ku sameyso isha
Haddii isku-xidhka hoose horey u tarjumo macmiilkiisa cinwaanka gudbinta, Pi wuxuu arkaa hal isha la tarjumay halkii ay ka ahaan lahayd cinwaanka u gaar ah macmiil kasta. Kani waa naqshad ka duwan tan sare ee ilaalinaysa isha. Wuxuu beddelaa siyaasadda ku salaysan isha, diiwaangelinta, iyo dhinaca bilaabi kara xiriirka. Labada naqshadba way shaqeeyaan; waxay ka jawaabaan su'aalo kala duwan.
Marka adeegga VPN ee sare diido inuu dib u maro hordhaca macmiilka, tarjumaad cidhiidhi ah oo ku taal bixitaanka tunnellada Pi waxay noqon kartaa xal sharci ah oo ku meel gaar ah. Taasi ma aha caddayn in waddada maqan ay ahayd mid aan loo baahnayn. Diiwaangeli cinwaanka shabakadda fog dhab ahaan aragto iyo waddada dib u noqodka ka soo baxda.
Doorashada waddada, fasaxa gudbinta iyo tarjumaadda isha waxay ahaanayaan saddex shaqo oo gooni ah. Nadiifinta silsilad NAT la wadaago ama fasaxa interface kasta sababtoo ah hal macmiil xadhig leh ayaa shaqeeya waa habka imtixaan shaqeeya uu u noqdo gudbiye furan.
Ka caddee tan mishiinka macmiilka
Dir codsi mishiin ku yaal LAN-ka hoose, ka dib raac ishiisa bannaanka iyo dib. Ping uu Pi diro marnaba ma isticmaalo waddada dib u noqodka hoose, sidaas darteed ping guulaystay wuxuu caddeeyaa wax ka yar inta muuqata. Ku dar imtixaan labaad oo ka yimid macmiil xadhig leh oo ku yaal LAN-ka Pi, si labada waddo loo barbardhigi karo. Ku celi labadaba ka dib dib u kicinta qalab kasta.
Waddooyinka gacanta lagu daray iyo tarjumaadaha aan waligood la keydin ayaa wada baxa. Markaas lammaanku wuxuu u muuqdaa cillad cusub halkii uu ahaan lahaa shaqo aan dhamaystirnayn.
Keydi qaabka isku-xirka oo ay la socdaan waddooyinka, adeegga gaarka ah ee la fasaxay iyo tarjumaad kasta oo ku jira hal qoraal. Qoraalkaas ayaa ka hortagaya qofka xiga inuu meelaynta wireless u arko su'aal siyaasadeed oo marinnimo.