Engeza i-VPN yesayithi eceleni kwe-router ye-ISP ngaphandle kokuphula izingcingo

Izindawo eziningi ezincane sezivele zinedivayisi eyodwa eyenza i-inthanethi, i-DHCP kanye nolayini wezwi, futhi leyo divayisi ngeke isebenzise umhubhe wesayithi sakho. Ukwengeza i-gateway yesibili yendlela eyimfihlo kuyasebenza uma unquma ukuthi ubani ungumnikazi waluphi uhlobo lwendlela ngaphambi kokuthinta ikhebula. Ingozi yangempela akuwona umhubhe; ukushintsha buthule idivayisi egcina izingcingo zibhalisiwe. Yenza lezi zivivinyo ezinhlanu ngokulandelana bese uma lapho eyodwa yehluleka khona.

Bhala phansi izindima esezisebenza

Qopha i-gateway ezenzakalelayo, iseva ye-DHCP, isixazululi samagama kanye nedivayisi enombhaliso wezwi lomhlinzeki. Kulesi sibonelo i-router ye-ISP ingu-10.50.0.1, i-gateway entsha izoba ngu-10.50.0.2, futhi isayithi elikude ngu-10.60.0.0/24. Akukho kulolo hlelo okushintsha izindima ezintathu zokuqala, futhi yilokho okubalulekile. Bese uqinisekisa ukuthi ibhokisi lesibili lingayiqeda ngempela imhubhe: bheka iphrothokholi, umsebenzi omuhle olindelekile kanye nokuthi ithola izibuyekezo ze-firmware noma zephakheji yini. Idivayisi enophawu lwe-VPN engakwazi ukuthola izibuyekezo ingumthwalo, hhayi isengezo.

Uma ungakwazi ukusho ukuthi ubani umnikazi wesevisi yezwi, ma. Ukushintsha i-router enombhaliso ngaphandle kohlelo lokubuyisela kuguqula iphrojekthi ye-VPN ibe ukuphazamiseka kwezingcingo.

Nikeza i-gateway entsha ikheli elilodwa nomsebenzi owodwa

Beka eceleni ikheli layo le-LAN ngaphandle kwedamu le-DHCP ukuze lingasuswa ngemuva kokuqalisa kabusha, futhi ungayinikezi indlela ezenzakalelayo yayo ngaphandle uma ufuna ibe yindlela ye-inthanethi. Umsebenzi wayo ukubamba umhubhe nokuphendula ama-prefix akude. Kumabhokisi e-LAN okumelwe afinyelele isayithi elikude, khombisa ukuthi yiluphi uhlobo lwendlela abayithathayo manje nokuthi iyiphi oyifunayo ngemuva koshintsho; imiyalo emibili efanayo ngaphambi nangemuva iwubufakazi obushibhe kakhulu.

ip route get 10.60.0.55
ip neigh show 10.50.0.2
traceroute -n 10.60.0.55

Uma usesho lubuyisela i-router ye-ISP futhi i-traceroute ifela emkhawulweni we-inthanethi, umsingathi akanayo indlela ekude okwamanje, okulindelekile. Uma kubuyisela okungalindelekile, xazulula lokho kuqala, ngoba sonke isinyathelo esilandelayo sicabanga lesi sisekelo.

Khetha ukuthi ubani umnikazi wendlela ye-prefix ekude

Inketho A yi-router ye-ISP: igcina indlela emile ye-10.60.0.0/24 ebheke e-gateway, futhi umsingathi ngamunye ulandela i-gateway yakhe ezenzakalelayo njengakuqala. Inketho B ingeyomsingathi ngamunye: kuphela imishini edinga isayithi elikude ethola indlela ecacile nge-10.50.0.2, futhi konke okunye kuhlala kungathintwanga. A ihlanzekile kumabhokisi amaningi, kepha ngokuvamile idinga ukuthi i-router yomhlinzeki yamukele indlela emile, okuyinto abanye abangayenzi. B ayidingi ukubambisana komhlinzeki kepha ishiya ukunakekelwa kokumiswa kwababhokisi kuwe, ngakho ifanele iqembu elincane lemishini egunyaziwe.

Kuzo zombili izimo indlela yokubuyela kufanele ibe khona. Uma impendulo ekude ifika ku-gateway futhi i-gateway iyidlulisela ngqo kumsingathi we-LAN, ithrafikhi idlula isimo se-firewall i-router ye-ISP eyayisigcine endleleni yokuphuma. Uma i-gateway ingeyona i-router ezenzakalelayo ye-LAN, lokho kungalingani kuyisinqumo somklamo, hhayi iphutha elinganganakwa.

ip route add 10.60.0.0/24 via 10.50.0.2 dev eth0
ip route get 10.60.0.55 from 10.50.0.77

Yenza ukufakwa kube okunomphela ngomnini wokumiswa komsingathi, hhayi ngeskripthi sokungena. Indlela ekhona kuphela ngemuva kokuthi othile angene izohluleka ngokokuqala lapho umshini uqalisa kabusha ngesizathu esingahlobene.

Lungiselela indawo yokungena efinyelelekayo

I-gateway idinga ikheli isayithi elikude elingafinyelela kulo. Ngemuva kwe-router ye-ISP lokho kusho ukudluliselwa kwephothi noma ukufakwa kwe-DMZ, futhi kokubili kuncike ekutheni umhlinzeki uyayiletha ngempela yini ithrafikhi. Ukudlulisela kwendawo akukwazi ukweqa i-NAT yezinga lomhlinzeki ohlangothini lomhlinzeki. Uma umhlinzeki enganiki iphoyinti elifinyelelekayo, phendula indlela: vumela zombili izayithi ziqale zibheke isizinda osilawulayo. Lowo umklamo ovumelekile, kepha wengeza ukuncika kwesithathu ekudluliseni, ekuthembeni nasekutholakaleni, futhi i-DNS eguqukayo ayikubuyiseli lokho.

Qinisekisa ukudlulisela ngokuthwebula ku-gateway, hhayi ngewebhusayithi ehlola amaphothi. Abahloli babika iphothi livaliwe kuze kuxhunywe isilaleli, futhi ukudlulisela okungakaze kulethe ithrafikhi kubonakala ngaphandle njengephothi elivaliwe.

Yamukela isevisi eyimfihlo nolayini wezwi kanyekanye

Hlola ukusebenza okuhlosiwe kusuka kumsingathi we-LAN, nge-DNS eyimfihlo nezifakazelo zohlelo lokusebenza ngokwalo. Umhubhe onendlela awenzi ukuphequlula kude kufane nengxenye ye-Ethernet yendawo, ngakho ukutholakala nokuxazululwa kwamagama kudinga amalungiselelo awo.

curl -sS -o /dev/null -w '%{http_code}\n' https://files.example.net
ping -c 3 10.60.0.55

Bese uqinisekisa ukuthi ukufinyelela okujwayelekile kwe-inthanethi kusasebenza kusuka kumsingathi ofanayo futhi izingcingo zisabhalisiwe; lezo zivivinyo ezimbili zibamba ushintsho lwengozi lwendlela ezenzakalelayo, okuyindlela evame kakhulu le phrojekthi eyephula ngayo into engazange ihlose ukuyithinta. Qeda ngenothi lokubuyisela elibhaliwe: iyiphi idivayisi ephethe iyiphi indima, amakheli abekiwe, nokuthi ungayisusa kanjani indlela ye-prefix ekude esinyathelweni esisodwa. Indlela eyimfihlo engahoxiswa ngokuhlanzekile ibaluleke kakhulu kunaleyo esebenza namuhla kuphela.