Ku marso hal subnet LAN OpenVPN oo hayso marinka caadiga ah
Hayso marinka caadiga ah ee LAN inta hal subnet uu maro tunnel-ka. Isbarbardhig shaxda siyaasadda iyo wax ka beddelka shaxda weyn, kadib dooro NAT ama marrin dhanka server-ka.
Qalabka LAN u marrinaya oo isla waqti ah VPN u wacaya waxay galaan isla dood laftooda: tunnel-ku wuxuu rabaa inuu yeesho marinka caadiga ah, LAN-na wuxuu u baahan yahay inuu dib u helo. Marka OpenVPN uu xirmo, wuxuu rin karaa marin caadi ah tunnel-ka dhexdiisa ama laba nus-marin caadi ah, taas oo sax u ah laptop-ka khaladna u ah albaabka jaarkoodu ay ka filaan jawaabo cinwaanka LAN-ka. Jawaabtu ma aha in VPN la dhaafo. Jawaabtu waa in labada go’aan la siiyo shaxo kala duwan.
Hal marin caadi ah, laba mulkiile
Taraafikada la gudbiyo iyo taraafikada maxalliga ah ee ka soo baxa ma aha inay maraan isla waddo. Macaamiisha LAN waxay tunnel-ka uga baahan yihiin oo kaliya meelaha aad dooratay, halka fadhiyada maamulka ee host-ka laftiisa iyo jawaabaha uu siiyo macaamiishaas ay uga baahan yihiin marinka caadiga ah ee LAN. Labada oo lagu daro shaxda weyn waxay ku qasbaan jawaab keliya laba su’aalood oo kala duwan.
OpenVPN waxa uu leeyahay shidde loogu talagalay si sax ah tan. route-noexec waxa uu ka horjoogsadaa macmiilka inuu taabto shaxda weyn, qiimayaashana uu isticmaali lahaa waxaa loo dhoofiyaa skript route-up sida route_vpn_gateway, dev iyo cinwaannada interface-ka. Kadib adigaa go’aansanaya shaxda keeba helaya marinka kee, kood aad hadhow akhriyi karto.
Shaxda siyaasadda iyo dib u qorista shaxda weyn
| Approach | What it buys | What it costs |
|---|---|---|
| Separate table plus source rule | LAN traffic and host traffic keep independent defaults | Every lookup now depends on rule order |
| Editing the main table only | Fewer moving parts on a single-purpose host | One mistake takes the gateway offline entirely |
| Two half-default routes | Works for a full-tunnel client | Ambiguous on a host that must answer on its LAN address |
Shaxda gaar ah waa doorashada kaliya ee ka baxda hal subnet. Mar uun magac sii, kadibna magac ku tixraac si aan qofna u xafidin lambar:
echo "10 vpn" >> /etc/iproute2/rt_tables
ip rule add from 192.168.50.0/24 table vpn
ip route add default via 10.8.0.1 dev tun0 table vpnCinwaannada halkan waa meel-banaan. Ka hor inta aadan wax shaqayn, ka beddel prefix-ka LAN, albaabka tunnel-ka iyo magaca qalabka ee hawshaada gaarka ah.
Xeerku waa inuu la jaanqaado host-kana
Xeerka kaliya ku habboon prefix-ka LAN wuxuu daboolaa baakadaha la gudbiyo. Ma daboolo taraafikada uu albaabka laftiisu abuuro, mana daboolo jawaabaha uu ku celiyo macaamiisha LAN, kuwaas oo sida isha u qaata cinwaanka LAN ee albaabka. Raadintaas waxay ku dhacdaa main oo wali way ka bixi kartaa tunnel-ka.
Ku dar xeer labaad oo ku saabsan cinwaanka LAN ee albaabka laftiisa, ama ballaari xeerka koowaad ilaa koox ay ku jiraan labadaba. Nidaamka ayaa muhiim ah: xeerka gaarka ah ee cad hore dhig, kadibna natiijada ku hubi raadin si cad u sheegta isha.
ip route get 203.0.113.9 from 192.168.50.1Haddii taas ay ka warbixiso qalabka tunnel-ka meel u qalanta inay maxalli ahaato, kooxda xeerarka waa khalad iyada oo aan loo eegin waxa shaxda ku jira.
NAT ama marin dhanka kale
Server-ka VPN waxa uu yaqaan subnet-ka tunnel-ka oo wax kale ma yaqaan. Baakadaha ku yimaada cinwaan isha LAN ma laha waddo dib u laabasho ilaa qof u diyaariyo, waxaana jira laba siyaabood oo sax ah oo loo diyaariyo. Ku darista marin loogu talagalay prefix-ka LAN server-ka waxay isha asalka ah ka dhigtaa mid muuqata laga bilaabo daraf ilaa daraf, taas oo ay badanaa rabto naqshad la kormeeray. Maskerade-ka albaabka wuxuu isha ku dib u qoraa cinwaanka tunnel-ka oo uma baahna wax iskaashi ah server-ka.
iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADEDooro NAT marka aadan maamulin server-ka oo aadan ku dari karin marino halkaas. Dooro marinka dhanka server-ka marka logs, xakamaynta gelitaanka ama isku-dheellitirnaanta waddada dib u laabashada ay muhiim yihiin, sababtoo ah maskerade-ku wuxuu tirtiraa cinwaanka asalka ah wax kasta oo dhanka kale diiwaangeliyo.
Si kastaba ha ahaatee gudbintu waa inay shaqaysaa, shaandhaynta adag ee waddada dib u laabashada waxay tuuri kartaa jawaabta marka main aanu dooran lahayn tunnel-ka ishaas. Hubi qiimaha dhabta ah ka hor inta aadan tunnel-ka eedayn.
Ka dhig kala-qaybinta mid ka badbaadda dib u xirashada
Xeerarka iyo marinnada gacanta lagu daray way libdhayaan marka interface-ka dib loo abuuro, diiwaanka shaxda duugoobayna wuxuu ka noolaan karaa fadhigaas oo caddeeyay. Ku dhex dhig xeerka shaxda, marinka tunnel-ka iyo diiwaanka maskerade-ka skript-ka route-up macmiilka, kadibna shaxda ka nadiifi bilowga skript-ka si albaab hore uusan ugu noolaan karin fadhiga cusub.
Ka hubi labada daraf: raadin albaabka oo isha LAN ah, iyo codsi dhab ah oo ka yimaada macmiil LAN una socda meel ay tahay inuu dhex maro tunnel-ka. Marrin jira laakiin aan waligiis la dooran, wuxuu u dhaqmaa si la mid ah sida aanu marin jirin ilaa aad akhrido tiriyeyaasha.