Sababta Server-ka VPN ee ka dambeeya CGNAT uusan waligiis aqbalin xiriir

Router-ku waxa uu soo sheegaa cinwaan WAN oo ku bilaabma 100.72, magaca DNS firfircoon waxa uu ku xalliyaa cinwaan kale oo dadweyne, server-ka VPN ee router-kaasna waligiis ma dhammeeyo gacan-qabsasho dibadda ah. Port forwarding waa la habeeyay, adeeggu wuu shaqeynayaa, imtixaanka LAN-na wali wuu shaqeeyaa. Waxba kuma muuqdaan log-ga router-ka oo qalad u eg. Isku-dhafkaas waa NAT heer shirkadeed, oo ma jiro qaanuun firewall ah oo furi kara port ku yaal cinwaan uu ISP-ga haysto.

Xaqiijinta cinwaanka la wadaago waxay qaadataa laba daqiiqo oo waxay ka hortagtaa toddobaad isbeddelo habeyn ah.

Calaamadaha tilmaamaya NAT-ga shirkadda

Isbarbar dhig cinwaanka WAN ee bogga xaaladda router-ka iyo cinwaanka ay soo sheegto baaritaan dibadda ah. Cinwaan WAN ku dhex jira 100.64.0.0/10 waa calaamadda caadiga ah, iyo xadadka gaarka ah 10/8, 172.16/12 iyo 192.168/16 waxay ka dhigan yihiin isku mid. Haddii traceroute muujiyo isla boodboodka dadweynaha oo soo noqnoqda, ama boodbood hore ku jawaabo cinwaan gaar ah, waxa jira turjubaan kale oo u dhexeeya router-ka iyo internet-ka. ISP-yada qaar waxay ku taxaan cinwaanka la qoondeeyay kaliya portal-ka macmiilka, sidaas darteed u dhoofi qiimahaas traceroute-ka.

Beddelka borotokoolada ama port-yada ma caawiyo, sababtoo ah dhibaatadu waa gaaritaanka soo-gelitaanka ee ma aha port xiran.

Sababta forwarding-ka iyo DNS firfircoon uusan u hagin karin

Qaanuunka port-forwarding wuxuu isku xiraa port ku yaal interface-ka WAN ee router-ka, laakiin taraafikada soo-gelaysa waligeed ma gaarto interface-kaas: ISP-ga ayaa marka hore turjuma oo kaliya gudbiya waxa ay ogolaato shaxdiisa. Daabacaadda cinwaanka la wadaago ee DNS firfircoon waxay macaamiisha u jeedisaa gateway ISP oo ay isticmaalaan macaamiil badan, taas ayaa sababta magacu u xalliyo oo gacan-qabsashadu wali fashilanto. Imtixaannada hairpin way guulaystaan sababtoo ah router-ku wuxuu ka jawaabaa qaanuunkiisa gudaha, UPnP-na waxay leedahay isla barta indhaha la'.

Dib-u-habeynta macmiilka sidoo kale ma caawinayso, sababtoo ah fashilku wuxuu dhacaa ka hor inta aan la akhrin wax habeyn macmiil ah.

Ku gudbi VPS oo leh waddooyin cad

Hortiisa dhig cinwaan dadweyne adigoo kireynaya VPS-ka ugu yar ee qaadi kara taraafikada, kadib ka dhig router-ka guriga inuu u soo waco baxaya. UDP-ga baxa ee shabakadda guriga wuxuu dhaafaa NAT-ga shirkadda, sidaas darteed tunnel-ka waxa laga dhisaa gudaha oo VPS-ku wuxuu noqdaa barta ugu dambeysa ee la gaari karo. Dhinaca gurigu wuxuu noqdaa macmiil leh cinwaan tunnel go'an, ma aha server.

VPS-ka ku dar gelitaan hagaha macmiilka gaar u ah si server-ku u ogaado peer-ka leh subnet-ka guriga, oo ku dar waddo kernel u dhigma.

# /etc/openvpn/server/ccd/home-site.conf
ifconfig-push 10.8.0.10 255.255.255.0
iroute 192.168.50.0 255.255.255.0

# server.conf
client-config-dir /etc/openvpn/server/ccd
route 192.168.50.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"

Sadarka iroute wuxuu OpenVPN u sheegaa macmiilka hela taraafikada subnet-ka guriga; sadarka route wuxuu subnet-kaas geliyaa shaxda kernel-ka VPS si baakaduhu u galaan tunnel-ka. Adeeg la daabacay, ku dar qaanuun NAT goobta oo u gudbiya port-ka dadweynaha 10.8.0.10 oo hawlgeliso net.ipv4.ip_forward.

Ka tijaabi waddada dibadda

Xaqiiji boodbood kasta dhinaca dadweynaha, sababtoo ah tunnel guulaysta ma caddeeyo in adeeggu gaari karo. Xaaladda dhageysiga iyo qabashada baakadaha ee VPS waxay kala soocaan 'waxba ma imanin' iyo 'way timid oo waa la tuuray'.

ss -lunp | grep 1194
tcpdump -ni any udp port 1194
nft list ruleset | grep -A4 dnat

# from a phone on mobile data, not the home Wi-Fi
nc -vz -u 203.0.113.10 1194

Haddii qabashadu muujiso baakado ka yimid telefoonka laakiin jawaab ma leh, meesha xigta waa habeynta server-ka ama firewall-ka. Haddii qabashadu waxba muujin, macmiilku wali wuu xallinayaa ama cinwaan khaldan ayuu u dirayaa.

Beddelka mudan in hore loo qiimeeyo

Cinwaan IPv4 gaar ah oo ka yimid ISP-ga waa xalka ugu gaaban oo badanaa waa lacag bille ah oo yar. IPv6 asalka ah wuxuu meesha ka qaadaa turjumaanka labada dhinac marka VPN-ga, shabakadda macmiilka iyo diiwaannada DNS ay dhammaantood taageeraan. Lakab mesh oo leh router subnet gudaha shabakadda guriga wuxuu gaaraa isla gudbintaas VPS la'aan, laakiin qiimaha ku xiran ansixinta adeeg isku-dubarid.

Dooro gudbinta marka shuruuddu tahay gaaritaan soo-gelitaan deggan oo qaanuun kastaa waa inuu ku sii ahaado gacantaada. Dooro cinwaanka ISP-ga marka miisaaniyaddu ogolaato oo hadafku si fudud yahay inaad ka joojiso ka fikirka arrintaas.