VPN iyo LAN gurigu isku subnet bay isticmaalaan: marka hore raac wadada
Labada adaptar waxay sheeganayaan 192.168.1.0/24 oo hal wadoon oo keliya ayaa guuleysta. Raac liiska adaptarada, wadada guuleysatay iyo wadada soo noqodka ka hor inta aadan dib u tirin ama DNS eedayn.
Waxaad ku xirtaa VPN-ga xafiiska, calaamadda tray-ga way cagaar noqotaa, intranet-ku wuu soo degaa, oo printer-ka laba mitir ka fog ayaa joojiya jawaabta. Wadaagga subaxdii shaqeynayay ayaa isla mishiinkaas ku dhamaada waqtigiisa, mana jiro log sheegaya printer. Falcelinta koowaad waa DNS, sababtoo ah magac aan la xallin wuxuu u eg yahay magac aan jirin, laakiin dhibaatadu waa cinwaanka: laba adaptar ayaa hadda sheeganaya 192.168.1.0/24 oo hal wadoon oo keliya ayaa guuleysan kara horgalahaas. Raac arrintan sidaas oo kale oo waxaad arki doontaa adaptar kee ayaa qaaday ka hor inta aadan wax beddelin.
Ka bilow calaamadda, ma aha tunnel-ka
Calaamaddu waa baaxadda. Haddii intranet-ku shaqeeyo oo qalab kasta oo maxalli ah guuldareysto, tunnel-ku wuu caafimaad qabaa oo wadada maxalliga ah ma aha. Haddii qalabka maxalliga ahi shaqeeyaan oo intranet-ku guuldareysto, waa liddi. Haddii wax walba shaqeeyaan marka laga reebo hal host, waxaad eegaysaa hal cinwaan oo labada dhinac ka jira.
Qor hal cinwaan maxalli ah iyo hal cinwaan fog ka hor inta aadan taaban dejinta. “Printer-ka” lama tijaabin karo; 192.168.1.40 waa la tijaabin karaa. Hal tallaabo ayaa ka hortagta saacadda ugu badan ee lumta dhibaatadan, taas oo ah dib u qorista dejinta DNS ee go'aanka wadada.
Tallaabada 1: arag labada adaptar oo sheeganaya horgalaha
Fur Xiriirka Shabakadda (ncpa.cpl) oo akhri labada adaptar dhinac-dhinac. Adaptarka Ethernet wuxuu muujinayaa 192.168.1.50/24 iyo gateway 192.168.1.1. Adaptarka VPN wuxuu muujinayaa 192.168.1.201/24 oo uu server-ku soo diray. Labaduba waa sharci, labaduba waxay aaminsan yihiin in horgalahu on-link yahay, oo stack-ku wuxuu u hayn doonaa hal wadoon.
Get-NetIPAddress -AddressFamily IPv4 wuxuu taxaa cinwaannada, Get-NetIPInterface | Sort-Object InterfaceMetric-na wuxuu muujinayaa nidaamka uu stack-ku isticmaali doono. Tiirka metric-gaas waa go'aanka aad hadda akhrinayso, sidaas darteed qor tirooyinka halkii aad isku dayi lahayd inaad xafiddo.
Ku diid aragtida DNS si jaban: Resolve-DnsName printer.office.lan wuxuu soo celiyaa isla cinwaankii shalay. Magacu wuu xallimay; ka dib baakaddu waxay ka baxday adaptarka qaldan. Laba daqiiqo halkan waxay badbaadisaa galab dejinta xalliyaha.
Tallaabada 2: akhri wadada dhab ahaan guuleysatay
Find-NetRoute -RemoteIPAddress 192.168.1.40 wuxuu daabacaa interface-ka, boodboodka xiga iyo isha uu stack-ku u isticmaali lahaa cinwaankaas. U qaado natiijadan jawaab ahaan, ma aha tilmaan. Si aad u aragto qoraal kee lumay iyo inta, route print -4 wuxuu bixiyaa shaxda oo dhan.
Gaar ahaanshuhu wuxuu ka guuleystaa ujeeddada. 192.168.0.0/25 la diray wuxuu ka guuleystaa 192.168.0.0/24 maxalli ah sababtoo ah horgalahu wuu dheer yahay, sidaas darteed 192.168.0.0 ilaa 192.168.0.127 waxay ka baxaan tunnel-ka halka qaybta sare ay maxalli ku sii ahaanayso. In nus LAN ah uu lumo iyada oo aan fariin khalad ah jirin waa dhaqanka saxda ah ee shaxdaas.
tracert -d 192.168.1.40 wuxuu tan ka xaqiijiyaa shaxda dibadeeda: haddii boodboodka koowaad uu yahay cinwaan tunnel ah halkii uu ahaan lahaa router-kaaga, wadadu waa sheekada oo dhan. Linux-ka su'aal isku mid ah waa ip route get 192.168.1.40, oo daabaca cinwaanka isha iyo qalabka hal saf. Marka jawaabtu sheegto tun0, jooji eegista browser-ka.
Tallaabada 3: hubi wadada soo noqodka ka hor inta aadan macmiilka eedayn
Wadoon hore oo sax ah weli wuu guuldareystaa haddii dhinaca fog aanu jawaabi karin. Marka LAN-ga macmiilka lagu gaaro tunnel-ka, gateway-ga LAN-gaas waa inuu ogaadaa halka ay ku nooshahay barkadda tunnel-ka: ip route add 10.8.0.0/24 via 192.168.1.12 router-kaas, iyo push “route 192.168.1.0 255.255.255.0” server-ka si macmiillada u ogaadaan wadada soo noqodka.
Iyada oo aan lahayn qoraalka koowaad jawaabtu waxay ka tagtaa bartilmaameedka iyada oo u jeedda gateway-ga caadiga ah, kaas oo u gudbiya cinwaan gaar ah ISP-ga oo tuuraya. Calaamaddu waa hal jiho oo si khaldan ayaa loo akhrin karaa: codsiyadu waxay ka muuqdaan tun0, jawaabuhu marnaba ma muuqdaan.
Qaanuunka masquerade ee host-ka VPN wuxuu meesha ka saarayaa baahida wadadaas taagan: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE. Waxay kaloo qarinaysaa cinwaannada isha dhabta ah, taas oo ka dhigaysa su'aal kasta oo log dambe mid adag. Host bartilmaameed leh gateway caadi ah oo qaldan wuxuu soo saaraa aamusnaan isku mid ah, iyada oo ICMP dib u jeedin tahay xaaladda ugu fiican iyo god madow xaaladda caadiga ah, sidaas darteed qabashadu waxay u baahan tahay labada daraf.
Tallaabada 4: dooro hagaajin aad la noolaan karto
Tan waxaa loo isticmaalaa shan hagaajin oo aan la isku beddeli karin. Dooro iyadoo lagu saleynayo waxa ay tahay in la gaaro isla waqti qudha, ma aha iyadoo lagu saleynayo amarka ugu gaaban.
| Repair | What it fixes | What it costs |
|---|---|---|
| Flip interface metrics | Alternating access: office now, home later, never both | Get-NetAdapter -Name "Ethernet 2" | Set-NetIPInterface -InterfaceMetric 21; set the VPN adapter back to 5000. A client that rewrites metrics on connect defeats it |
| Renumber one side | Every host reachable in both directions | DHCP reservations, printer queues, firewall rules and hard-coded addresses all move |
| Narrow the advertised prefix | Remote hosts really live in the upper half | Breaks the day someone adds a host below the cut |
| Translate with client-nat | Both address plans stay untouched | Stateless per-client mapping, unreadable logs, anything embedding addresses breaks |
| Publish one service with DNAT | One service on the VPN host reachable from the LAN | Both address plans stay; source addresses and reverse lookups stop being meaningful |
Metric-ku waa xulashada jaban iyo tan dadku marka hore gacanta u dhigaan. Isbeddelku wuxuu khuseeyaa interface-ka, sidaas darteed wuu shaqeeyaa inta tunnel-ku kor yahay, oo booskiisu waa script-ka macmiilka agtiisa ee ma aha shell-ka aad illoobi doonto. Ma siin karo gelitaan isku mar ah isla cinwaanka laba shabakadood, oo xadkaas ayaa qof kasta oo kale u diraya shaxda hoosta.
Dib u tirinta LAN-ga guriga ilaa 10.10.0.0/24 waa xalka nadiifka ah: hal cusboonaysiin lease DHCP oo lagu daray ballamaha, safafka printer-ka iyo cinwaannada adag ee sheegaya xadka hore. Dib u tirinta dhinaca xafiiska caadi ahaan ma aha go'aankaaga. IPv6 wuxuu si buuxda u tirtiraa isku dhaca marka labada shabakadood ay qaadaan, isagoo isticmaalaya horgale maxalli gaar ah oo ka yimid fd00::/8 halkii uu ka ahaan lahaa wax la xafido, laakiin tijaabi barnaamijka TCP, ma aha ping, sababtoo ah ICMP wuu shaqeyn karaa iyadoo adeeggu aanu shaqeyn.
Xulashada turjumaad ee OpenVPN laftiisu waa dariiqa ugu dambeeya, oo laga riixo server-ka oo la geliyo qoraal galka macmiilka gaar u ah. Waxay qaadataa afar parameter ka dib magaca xulashada — jihada, shabakadda, netmask-ka iyo magaca beddelka — oo magaca beddelku ma aha ikhtiyaari: push "route 192.168.2.0 255.255.255.0" iyo push "client-nat dnat 192.168.2.0 255.255.255.0 192.168.1.0". Shabakadda iyo mask-ku waa xadka uu macmiilku arko (192.168.2.0/24), magaca beddelku waa xadka xafiiska dhabta ah ee dhinaca server-ka (192.168.1.0/24), wadada la riixdayna waa tan ka dhigaysa xadkaas la arki karo mid la gaari karo. Xafiisku markaas wuxuu u soo baxaa macmiilkaas 192.168.2.x hoostiisa. Diiwaangeli khariidaynta profile-ka, haddii kale qofka xiga wuxuu u baari doonaa sida khalad wado.
Daabacaadda hal adeeg waa nooca cidhiidhiga ah ee turjumaadda, mana u baahna xulashada OpenVPN haba yaraatee. Qaanuunka DNAT ee host-ka VPN wuxuu dib u daabacaa hal port, sidaas darteed LAN-ku wuu hayaa cinwaannadiisa oo wuxuu adeegga ku gaaraa cinwaanka host-ka uu hore u yaqaan. Qiimuhu waa kan caadiga ah: adeeggu wuxuu host-ka VPN u arkaa isha, sidaas darteed log-yada macmiil kasta iyo raadinta rogan ma yeelato macne. Taasi waxay daboolaysaa hal saf printer ama hal bog maamul, ma aha host-yada labada dhinac ee is gaara.
Maxaa weli shaqeyn doonin, iyo waxa la qorayo
Baahintu kama gudubto tunnel wado leh. DLNA, UPnP, baadhista NetBIOS iyo Wake-on-LAN waxay ku tiirsan yihiin baahin ama multicast oo qalabka tun uusan qaadin, sidaas darteed wadoon kuma hagaajiyo helista. Buundada dev tap waxay dheereysaa qaybta, oo la socota baahinta DHCP, ARP iyo baakad kasta oo kale oo helis ah; dooro wado host unicast ah sida route 192.168.2.1 255.255.255.255 cinwaanka dhinaca LAN ee router fog.
Laba router oo labaduba isticmaalaya 192.168.1.1 isla wadada waxay ka tirsan yihiin isla qoyska dhibaatada: cinwaanka maxalliga ah ayaa had iyo jeer guuleysta, sidaas darteed bogga router-ka fog wuu ahaanayaa mid aan la gaari karin ilaa hal LAN uu guuro. Ku darista adaptar labaad waxba kama beddelo labada xaaladood midkoodna.
Qor caddaynta ka hor inta aadan wax tafatirin: ip route get ama Find-NetRoute, ping -c 3 cinwaanka la hadal hayo, traceroute, iyo tcpdump -ni tun0 icmp macmiilka, ka dib shaxda wadada iyo tiriyayaasha NAT server-ka. Ping ku shaqeeya hal jiho oo ku dhinta jihada kale wuxuu tilmaamaa wadada soo noqodka, ma aha tunnel-ka, oo farqigaas qudha ayaa go'aaminaya hagaajinta sare ee aad dhab ahaan u baahan tahay.