Sababta NAT-ka gurigu uusan uga ilaalin karin interface-ka VPN
Router-ka gurigu wuxuu gudbiyaa tunnel-ka, laakiin host-ku wuxuu qiimeeyaa packet-ka la furay. Akhri dhageystaha, wadada gudaha iyo siyaasadda gelitaanka si gooni ah.
Laptop-yada ka dambeeya router guri oo aan lahayn port forwarding waxay wali aqbalaan isku-xirka SSH ee ka yimaada VPN. Taasi khilaaf maaha, sababtoo ah laba qalab oo kala duwan ayaa qiimeeya laba packet oo kala duwan. Router-ku wuxuu gudbiyaa transport-ka sirta ah, host-kuna wuxuu go'aansadaa waxa lagu sameeyo packet-ka la furay ee yimaada interface-ka tunnel-kiisa. In labadan go'aan la kala saaro waa layliska oo dhan.
Router-ku wuxuu gudbiyaa tunnel-ka, host-ku wuxuu qiimeeyaa packet-ka
Sawir wadada laga bilaabo isha fog ilaa adeegga ka hor inta aadan eegin hal xeer. Qaybta dibadda waa transport-ka VPN, oo uu maamulo router-ka iyo gateway-ga. Qaybta gudaha waxay bilaabataa marka endpoint-ku uu ka saaro lakabka tunnel-ka oo host-ku uu helo packet loo direy ciwaanka VPN-kiisa.
Isku dar labada qaybood oo router-ku wuxuu helaa sharaf go'aan uu host-ku qaato. Bogga port forwarding ama log-ga router-ku waxay sharraxaan kaliya wada-hadallo dibadda, mana jiro mid sheegaya traffic-ka la furay ee host-ku aqbali doono. Host-ku wuxuu ku dabaqaa siyaasaddiisa gelitaanka packet-ka gudaha, si la mid ah packet kasta oo yimaada interface. Siyaasaddaas ayaa su'aasha soo-gaadhista si dhab ah lagu go'aamiyaa.
Dhageyste wildcard ma aha adeeg dadweyne
Linux-ka, ku xidhnaanta INADDR_ANY waxay ka dhigan tahay ciwaan kasta oo maxalli ah, marka adeeggu wuxuu ka jawaabi karaa interface tunnel ah oo uusan waligiis magacaabin. Tixraaca socket-ka IP wuxuu sharraxaa xidhnaantaas, waana mudan in la akhriyo ka hor inta aadan ka soo saarin gabagabo liis dhageystayaal. Gelitaanka wildcard waa xaqiiqo ku saabsan socket-ka, ma aha sheegasho ku saabsan gaaritaanka.
Labada sadar ee hoose waa isla adeeg laba xidhnaan oo kala duwan, farqiiguna waa jawaabta oo dhan su'aasha ah miyay interface-ku muhiim tahay. Akhri ciwaanka uu socket-ku ku fadhiyo ka hor wax kasta oo kale.
ss -lntp "sport = :22"
LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
LISTEN 0 4096 10.8.0.6:22 0.0.0.0:* users:(("sshd",pid=812,fd=4))Magacaab habaynta laga yaabo inay gaarto port-ka
Saddex habayn ayaa packet dhigta interface-kaas, waxayna leeyihiin milkiilayaal kala duwan. Magacaabista tan saxda ah waxay go'aamisaa cidda mustaqbalka siyaasad beddeli doonta.
| Arrangement | What reaches the port | Where the decision lives |
|---|---|---|
| Another permitted VPN peer | A packet from the same tunnel subnet | Gateway forwarding policy and host input rules |
| A deliberate public forward | Traffic the gateway publishes on purpose | Gateway service definition |
| A subnet routed behind the gateway | Client traffic from the far side | Gateway route and host input rules |
Natiijada browser-ka oo muujinaysa ciwaanka bixidda dadweynaha waxba kama sheegto mid ka mid ah saddexda, sababtoo ah waxay sharraxaysaa sida traffic-ka baxa uu u baxo halkii ay ka sheegi lahayd waxa loo oggol yahay traffic-ka soo gala. Ka shaqee gadaal laga bilaabo dhageystaha iyo ciwaanka isha ee log-ga adeegga. Haddii ishu tahay peer tunnel kale, siyaasadda gateway-ga waa dukumeentiga xiisaha leh. Haddii ay tahay ciwaan la tarjumay, raadi tarjumaad ka hor inta aadan beddelin xeer.
Ku xaddid adeegga wadada aad uga danlahayd
Haddii SSH loo baahan yahay oo kaliya wadada maamulka, u qor wadadaas sida xadka isha iyo interface. Kadib ku xaddid xeerkii gelitaanka host-ka interface, meesha loo socdo iyo isha halkii aad ku xaddidi lahayd magaca shabakadda, sababtoo ah magac u eg mid gaar ah wuxuu u taagan karaa ciwaan kasta. U reeb wado qofka xallin doona dhibaatada xigta.
nft add rule inet filter input iifname "tun0" ip saddr 10.8.0.0/24 tcp dport 22 accept
nft list chain inet filter inputXeer magacaabaya interface-ka tunnel-ka iyo xadka maamulka wuxuu u sheegaa ujeedada hal meel. La barbardhig xeer loo qoray shabakadda Wi-Fi, oo waxba ka sheegayn traffic-ka tunnel-ka la furay. Marka labada lakab ay isku raacsanayn, siyaasadda host-ka ayaa ah tan packet-ku la kulmo.
Kaga tag gelitaanka iyo patch-yada si sax ah meesha ay joogaan; gaaritaanka port-ka waligiis lama mid aha oggolaanshaha in la isticmaalo. Diiwaangeli qoyska ciwaanka iyo waqtiga isha kasta oo aan la aqoon, oo baadh ka hor inta aadan eedeyn sifo ama nuglaansho. Xeer soo dhoweeya peer kasta oo tunnel-ka waa nashqad ka duwan tan soo dhoweysa subnet maamul, mana jiro sadar log oo sheegta tan loo jeeday.
Aqbal hagaajinta hal guul iyo hal diidmo
Caddee labada qaybood: hal isku-xir oo la ansixiyay wuu guuleystaa oo hal wado oo laga reebay waa la diiday. Diidmadu waa qaybta dadku boodaan, waana tan muujinaysa in xeerku shaqeynayo halkii uu ag taagnaan lahaa qiime caadi ah oo oggol. Ka tijaabi dhinaca laga reebay halkii aad ka fikiri lahayd.
Ku celi lammaanaha ka dib dib-u-xirasho, sababtoo ah tunnel ku soo noqda magac interface kale wuxuu si aamusan uga gudbi karaa xeer ku xaddidan kii hore. Xadka muhiimka ah waa tan host-ku ku dabaqo packets-ka uu dhab ahaan helo.