Gudbinta port-ka ee WireGuard peer ee NAT-ka ka dambeeya: DNAT iyo SNAT

Browser-ku wuxuu codsadaa https://203.0.113.10:8443, proxy-ga wuxuu aqbalaa xidhiidhka, adeegga ku yaal WireGuard peer-ka marnaba ma jawaabo. Xeerka DNAT wuxuu qabtaa shaqadiisa; qaybta guuldarraysta waa jawaabta. Raac paket-ka labada tarjumaadood oo xeerka maqan wuu caddaadaa. Xalku waa bayaan NAT oo dheeraad ah oo ku jira hook-ga saxda ah, ma aha tunnel cusub.

Raac hal codsi bilow ilaa dhammaad

Codsigu wuxuu yimaadaa interface-ka dadweynaha ee proxy-ga, isagoo isha u tahay cinwaanka dadweynaha macmiilka iyo bartilmaameedka cinwaanka proxy-ga. Gudaha nat PREROUTING xeerka DNAT wuxuu dib u qoraa bartilmaameedka cinwaanka tunnel-ka peer-ka, 10.90.0.2. Kadib go'aanka marinka ayaa paket-ka u diraya bannaanka iyada oo loo marayo wg0, dariiqa gudbintuna wuu dhammaaday.

Peer-ka paket-ku hadda wuxuu qaadaa cinwaanka isha dadweynaha ee asalka ah, sababtoo ah waxba dib uma qorin. Adeeggu wuxuu aqbalaa xidhiidhka oo jawaabtiisa u diraya gateway-ga caadiga ah ee u gaar ah, kaas oo ah router-ka guriga ee peer-ka hortiisa. Router-kaas ma laha xaalad qulqul uusan waligiis arag, sidaas darteed wuxuu tuurayaa paket-ka ama wuxuu u tarjumaa cinwaankiisa dadweynaha, taas oo macmiilku aanu aqbali doonin.

Asymmetry-ga waa dhammaan dhibaatada: codsigu wuxuu maraa proxy-ga, jawaabtuna waxay isku daydaa inay si toos ah u tagto. Dabagalka xidhiidhada proxy-ga wuxuu caawiyaa kaliya haddii jawaabtu ku soo noqoto proxy-ga, lamana soo noqon karo halkaas inta cinwaanka ishu weli tilmaamayo macmiilka asalka ah.

Ku dar tarjumaadda dib u noqodka

Dib u qor isha qulqulka la gudbinayo cinwaanka tunnel-ka proxy-ga ka hor inta uusan u tagin peer-ka. Kadib adeeggu wuxuu u jawaabaa 10.90.0.1, proxy-gu wuu qaataa, dabagalka xidhiidhaduna wuxuu rogaa labada tarjumaadood ka hor inta paket-ku uusan ku noqon macmiilka.

iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Xeerka POSTROUTING si ula kac ah waa cidhiidhi: wuxuu u dhigmaa bartilmaameedka la tarjumay iyo interface-ka tunnel-ka, sidaas darteed dib uma qoro taraafikada aan xidhiidhka lahayn ee si shil ah uga baxa wg0. Xeer masquerade ballaaran ayaa sidoo kale qarin lahaa cinwaanka macmiilka, laakiin wuu u samayn lahaa qulqul kasta oo wuxuu ka dhigi lahaa shaxda NAT mid adag in la baaro.

Dhig xeeryada meesha tunnel-ku ku yaal

Xeeryada tixraacaya cinwaanka tunnel-ka ama interface-ka waa inay shaqeeyaan ka dib marka wg-quick uu habeeyo. Interface-ka waxaa la abuurayaa PreUp ka hor, laakiin cinwaannada, MTU, DNS iyo dariiqyada ayaa la adeegsadaa ka dib, PostUp-na wuxuu shaqeeyaa marka waxaas oo dhan meeshooda yaallaan. Ku daridda geli PostUp, tirtiriddana PreDown.

PostUp = iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PostUp = iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1
PreDown = iptables -t nat -D PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PreDown = iptables -t nat -D POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Tirtiriddu waa inay la ekaataa ku daridda token token, oo ay ku jiraan is-waafajinta multiport iyo interface-ka. Tirtiris ku duwan hal is-waafajin waxba ma tirtirto, isku-xidhka xigana wuxuu ku daraa nuqul labaad oo xeerka ah. Isku-xidh dhowr ka dib shaxdu waxay ka kooban tahay nuqullo adag in lagu nisbeeyo safka habaynta.

Hubi natiijada iptables -t nat -S isku-xidh ka dib. Haddii isla xeerka uu laba jeer soo baxo, safka PreDown ma waafaqsana oo nadiifintu si aamusan ayay u guuldaraysataa.

Gudbin, shaandhayn iyo NAT-ka kale

Awood u yeel gudbinta IPv4 si joogto ah, kadibna oggolow qulqulka la gudbinayo shaxda shaandhaynta. DNAT wuxuu dhacaa silsiladda FORWARD ka hor, sidaas darteed xeerka shaandhaynta wuxuu u dhigmaa bartilmaameedka la tarjumay ee ma aha cinwaanka dadweynaha. Haddii UFW uu maamulo firewall-ka, muuji fasaxa sida xeer dariiq; xeer host caadi ah ma daboolo taraafikada la gudbinayo.

Laba lakab oo NAT ah ayaa weli jebin kara dariiqa xitaa marka xeeryada proxy-gu sax yihiin. Xidhiidhka guriga cinwaanka dadweynaha wuxuu leeyahay router-ka, furitaanka port-ka firewall-kiisana ma aha isku mid ah abuurista gelitaan gudbinta port-ka oo u dira port-kaas proxy-ga. Port-ka bannaanka ka muuqda isagoo waxba jawaabayn inta badan ma laha isla map-kaas.

NAT VPS-ka bixiuhu wuxuu map-gareeyaa port dadweyne cinwaan gaar ah. Map-ku waa inuu la ekaadaa port-ka aad ku dhawaaqdo, is-waafajin la'aantuna waxay u egtahay sida tunnel jabay. Xaqiiji map-ka bixiuhu ka hor inta aadan beddelin habaynta WireGuard.

Hubi dariiqa soo noqodka oo aqbal kharashka

Ka xidhiidh shabakad aan ahayn LAN-ka proxy-ga, kadibna baar lammaanaha tarjumaadda inta xidhiidhku furan yahay:

conntrack -L -p tcp --dport 8080
tcpdump -ni any tcp port 8080

Gelitaanka conntrack waa inuu muujiyaa tuple-ka asalka ah, tuple-ka la tarjumay iyo jihada jawaabta. Haddii jawaabtu maqan tahay, peer-ku ma dirayo tunnel-ka, taas oo badanaa macnaheedu yahay xeerka SNAT lama adeegsan ama firewall-ka peer-ka qudhiisa ayaa tuuray qulqulka.

Hal mar dib u bilaaw si aad u caddayso in PostUp dib u adeegsado xeeryada, kadib jooji tunnel-ka oo xaqiiji in PreDown uu ka tirtiray. Xeeryada dhintay ee ka badbaada go'itaanka ayaa ah sababta isbeddel dambe uu u dhaqmo si aan la saadaalin karin.

Ugu dambayntii, aqbal waxa SNAT ku kacayo. Adeeggu wuxuu arkaa codsi kasta oo ka yimid proxy-ga, sidaas darteed diiwaannada gelitaanka, xaddidaadda xawaaraha macmiil kasta iyo liisaska cinwaannada la oggolaaday ma kala soocaan isticmaalayaasha. Xaaladda hairpin waxay u baahan tahay tarjumaad isha u gaar ah macmiiliinta ku jira LAN-ka proxy-ga. Haddii peer-ku u baahan yahay cinwaannada dhabta ah ee macmiilka, beddelka waa dariiq soo noqod oo ku socda shabakadda macmiilka, taas oo shaqo badan laakiin ilaaliso macluumaadka.