Gaaritaanka /24 fog iyada oo loo marayo tunnel: NETMAP, DNAT ama waddo?
Khariidayso dhamaan prefix-ka NETMAP, ku dar xeerar DNAT host kasta ama wado baaxadda dhabta ah, oo go'aanso waxa dhinaca fog ay tahay inuu arko iyo yaa bilaabi kara taraafikada.
Waxaad gaari kartaa shabakad hoosaad ka dambeeya dhibicda tunnel-ka saddex siyaabood, iyo hal daqiiqo xog ururin ayaa badanaa meesha ka saarta laba. Xaqiiqooyinku waa haddii server-yada halkaas jooga ay tahay inay kala garaan isticmaalayaasha, haddii qof halkaas jooga uu waligiis wacayo xagga baaxaddaada, iyo yaa wax ka beddeli kara router-ka dhinaca fog. Ka jawaab saddexdan oo naqshaddu iskeed bay dooranaysaa. Inta kale waxay u malaynaysaa inaad maamusho dhibicda tunnel-ka oo aad wax ka beddeli karto firewall-keeda.
Saddex ikhtiyaar, iyo waxa mid kastaa dhab ahaan beddelo
Khariidadaynta prefix-ka, DNAT host kasta iyo prefix la wado dhammaantood waxay u dhexeeyaan isla labada baaxadood, laakiin waxay beddelaan waxyaabo kala duwan. Khariidadayntu waxay abuurtaa baaxad alias oo cinwaannada si xisaabeed ugu dib u qortaa inta safarka. Xeerarka host kastaa sidoo kale dib u qoraan, marka laga reebo in goob kasta gacan lagu magacaabo. Prefix la wado waxba dib uma qoro: baakaduhu waxay hayaan cinwaannada dhabta ah labadana dhinac way isku raacsan yihiin halka ay cinwaannadaasi ku nool yihiin.
| What the far side needs | Prefix mapping | Per-host DNAT | Routed prefix |
|---|---|---|---|
| Users visible to its logs | Only without source NAT | Same condition | Yes, unchanged |
| To start a connection toward you | No, alias is local | No, same reason | Yes, both ends route |
| To absorb a new host | Yes, arithmetic only | No, one rule per address | Yes, it simply routes |
| To require no config change | Yes, with source NAT | Yes, same condition | No, it needs a route back |
Ka bilow ka saarista dhinaca fog, halkaas oo xaddidaadaha ugu adag yihiin in la beddelo. Haddii server halkaas jooga uu cinwaannada macmiilka ku qoro logs, uu ku hubiyo liiska loo ogol yahay ama uu u gudbiyo nidaam kale, turjumaadda isha waxay baabbi'isaa aqoonsigiisa kaliya. Haddii dhinaca fog sidoo kale uu gudaha u wacayo, turjumaaddu gebi ahaan waa laga reebay, sababtoo ah halkaas qofna ma oga in alias-ku jiro. Kaliya marka dhinaca fog uu kaliya ka jawaabo codsiyada ay ikhtiyaarada jaban noqdaan kuwo amni ah.
Lammaane prefix, iyo sababta cabbirradu isku mid noqon lahaayeen
NETMAP waa bartilmaameedka shaxda nat oo ka shaqeeya lammaane prefix oo isku dherer ah. Gudaha kuma laha shax cinwaan kasta: wuxuu ka qaadaa prefix-ka, wuxuu hayaa bits-ka host oo dib ugu dhejiyaa prefix-ka cusub, sidaas darteed /24 waxaa loo khariidaystaa /24 oo waligiis /25 ma noqoto. Goobtu waxay go'aamisaa jihada: isku-dhacka goobta ee PREROUTING wuxuu dib u qoraa halka baakadku tago, isku-dhacka isha ee POSTROUTING wuxuu dib u qoraa halka uu ka yimid.
Host ku yaal 192.168.2.17 wuxuu macmiiliintaada uga muuqdaa 10.50.1.17, octet-ka ugu dambeeya ma aha qurxin — waa isla lambarka labada dhinac. Berri ku dar host 192.168.2.40, alias-kiisu waa 10.50.1.40, xeer la beddelo ma jiro.
Macmiiliintu waxay weli u baahan yihiin waddo loogu talagalay baaxadda alias oo u jeedda sanduuqaaga, haddii aanu alias-ku ku dhicin shabakad hoosaad ay horey u gaaraan. Gateway-ga uma baahna waddo alias-ka, sababtoo ah turjumaadda goobta waxay ku socotaa PREROUTING, ka hor raadinta waddada. Gudbintuna waa inay furan tahay, haddii kale kernel-ku wuxuu tuurayaa baakadda dib u qorista ka dib. Saddexda amarro ee hoose waa dhammaan habeynta gateway-ga qaab Debian ah oo macmiiliintu ku yaalliin br0, alias-ku 10.50.1.0/24 iyo tunnel-ku tun0.
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i br0 -d 10.50.1.0/24 -j NETMAP --to 192.168.2.0/24
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADEJawaabtu waa inay iyadu hesho waddada dib ugu noqoshada
Dib u qorista goobta waxay kaliya go'aamisaa halka baakadka la geeyo. Server-ka fog wali waa inuu ka jawaabo cinwaan uu gaaro, taasna laba siyaabood ayaa loo habayn karaa. Turjun isha si jawaabtu ugu soo noqoto sanduuqaaga, ama ka tag isha oo dhinaca fog sii waddo loogu talagalay baaxadda macmiilka.
Masquerade dhinaca bixitaanka waa waddada gaaban: hal xeer oo POSTROUTING ah iyo dhinaca fog wuxuu arkaa cinwaanka tunnel-kaaga, markaa uma baahna waddo u gaar ah. Qiimuhu waa in isticmaale kastaa uu ku dumo hal cinwaan, logs-ka isticmaale kastaa macne ma yeesho. Haddii isha aad ka tagto iyada oo aan la taaban, macluumaadkaas waa la hayn, laakiin markaas goobta fog waa inay jawaabaha baaxadda macmiilka ku celiso tunnel-ka.OpenVPN server-ka waa push la diray push "route 10.50.9.0 255.255.255.0", iyo sidoo kale route 192.168.2.0 255.255.255.0 sadar.
Guuldarada qaaliga ah waa in qayb kasta badhkeed la sameeyo. Haddii aad masquerade ka sameyso qayb ka mid ah taraafikada inta dhinaca fog uu sidoo kale qaado waddo dib u noqosho oo taraafiko kale ah, jawaabuhu waxay soo galaan interface aan waligiis la arag diiwaanka dabagalka xiriirka. Macmiilku wuxuu soo sheegaa timeout codsi uu server-ku u diiwaangeliyay mid la adeegay. Labada jiho ee qulqulka waa inay maraan isla netfilter instance: hal gateway ayaa turjumaya, ma aha laba firewall oo isku xigxiga.
conntrack -L -d 10.50.1.17
iptables -t nat -L PREROUTING -v -nAkhri diiwaanka labada jiho: tuple-ka asalka ah wuxuu hayaa alias-kaaga goobta, tuple-ka jawaabtuna wuxuu qaadaa cinwaanka dhabta ah. Haddii tuple-ka jawaabtu maqan tahay, dhibaatadu ma aha xeerka, waa waddada dib u noqoshada. Haddii counters-ka PREROUTING aanay waligood dhaqaaqin, baakadku waligiis ma gaarin hook-kaas.
Isku dhacyo iyo raadinta marka hore socota
Laba baaxadood oo kala duwan way isku dhaci karaan, labada guuldareedba waxay u muuqdaan tunnel jaban halkii ay ahaan lahaayeen xeer xun. Alias-ka aad abuurto waa inuusan ku dhex jirin waddada oo dhan, baaxadda fog ee dhabta ahna waa inaanay horey ugu jirin shabakadaada. Nuqulku wuxuu keenaa taraafiko goos goos ah oo u socda host khaldan, taas oo ka adag in la ogaado xiriir la diiday. Weydii shaxda waddooyinka ka hor inta aadan xeer ku darin.
Gateway-ga, ip route get 192.168.2.17 waa inuu magacaabo qalabka tunnel-ka; bridge maxalli ah macneheedu waa baaxadda fog waa la hadhiyay oo nat xeer ma hagaajin karo. Haddii shabakadaadu horey u isticmaasho 192.168.2.0/24, dib u lambar goobta fog halkii aad khariidad ku dul saari lahayd isku dhaca.
Ka tijaabin macmiil dhab ah, kadibna haynta
Ka tijaabi mishiin dhab ahaan isticmaali doona alias-ka, ma aha gateway-ga, sababtoo ah taraafikada maxalliga ah lagu abuuray marnaba si isku mid ah uga gudbi maayo PREROUTING. Fur xiriir host alias leh oo daawan counters-ka iyo diiwaanka conntrack oo wada soo baxaya, kadibna xir oo xaqiiji in diiwaanku tago. Diiwaan duugoobay wuxuu tilmaamaa xiriir badh furan, taas oo badanaa macneheedu yahay jawaabtu waligeed soo noqon.
curl -sv http://10.50.1.17/ -o /dev/null
ss -tn dst 10.50.1.17
conntrack -L -d 10.50.1.17Laba ama saddex xiriir oo guulaysta waxay caddeeyaan xisaabta, laakiin wax kama sheegaan sii jirista ama injineerka xiga. Kaydi xeerarka meesha habka boot-ku ka akhriyo, taas oo Debian iyo Ubuntu ku tahay iptables-save > /etc/iptables/rules.v4 iyadoo netfilter-persistent la shidayo. Khariidad ku baaba'a dib u bilowga waa ka xun waxba, sababtoo ah khalka wuxuu yimaadaa isbeddel dhaw oo la canaanan karo la'aan.
Xeerarka agtooda ku reeb qoraal: baaxadda alias, baaxadda dhabta ah, sababta lammaanaha iyo dhinac kee ayaa bilaabi kara. Qoraalkaas wuxuu kala saaraa naqshad iyo xeerar aan cidna ku dhicin inay tirtirto. Wuxuu kaloo xalliyaa su'aasha dambe, marka goobta fog ay ku darto host iyo cinwaan aan cidna habayn oo horey uga jawaabaya. Haddii qoraalku sheego in dhinaca fog uu u baahan yahay waddo dib u noqosho, qofka xiga wuu ogyahay in xeerka masquerade-ka laga saaro uu jebiyo xiriirka. Dukumeentigu halkan waa jaban; dib u helista ku-tiirsanaanta NAT saddexda habeenimo ma aha.