I-NAT ekabili kanye ne-VPN yakho: iklayenti liyasebenza, iseva ayisebenzi

Irutha yakho ingemuva kwelinye irutha, ikheli le-WAN lingelomuntu siqu, futhi iklayenti le-VPN liyaxhumana noma kunjalo. Le nhlanganisela iyamangaza abantu abalindele ukuthi i-NAT ekabili izophula amashubhu, kodwa ukuxhumana okuphumayo yikho okusingathwa kahle kakhulu ukuhumusha. Ukusingatha iseva ye-VPN ngemuva kwalezo zingqimba ezimbili yisimo esivame ukwehluleka. Dweba indlela yokuxhumana ngaphambi kokushintsha noma yini.

Qala ngokudweba indlela yokuxhumana

Vula ikhasi lesimo lerutha yangaphakathi bese ubhala ikheli layo le-WAN, bese uliqhathanisa nekhasi elikubikela lona insizakalo yomphakathi. Uma womabili ehluka, kukhona okungenani umhumushi oyedwa phakathi kwerutha yakho ne-inthanethi. Uma ikheli le-WAN liwela ngaphakathi kwe-100.64.0.0/10, umhumushi wangaphandle cishe ungowomhlinzeki wakho, futhi awuwulawuli. Lawa maqiniso amabili anquma ukuthi yisiphi isinyathelo sakamuva esingasebenza.

curl -s https://ifconfig.me
ip -brief address
traceroute -n 1.1.1.1

I-NAT ekabili ayiyona i-VPN ekabili. Ukuhumusha kubhala kabusha amakheli namachweba; akunezi ishubhu lesibili elibethelwe, futhi akubethelanga lutho. Ukuhlukanisa le mibono emibili kubalulekile ngoba izixazululo zihluke ngokuphelele, futhi esinye sazo sidinga ingxoxo nomhlinzeki wakho esikhundleni sekhasi lezilungiselelo.

Ukuphuma: iklayenti liyabuza, abahumushi bayafanisa

Ishubhu eliphumayo liqala ngephakethe elivela emshinini wakho, ngakho umhumushi ngamunye angakha ukufaniswa bese evumela impendulo ukuthi ibuyele ngaphakathi. Iphrothokholi, ichweba nezibali zesikhathi sokungenzi lutho zinquma ukuthi lokho kufaniswa kuhlala isikhathi esanele yini ukuze kube usizo. Amarutha amaningi abasebenzisi akusingatha lokhu ngaphandle kokucushwa.

Ukwehluleka okuvela ngempela ngokuvamile kumayelana nokuphelelwa yisikhathi nokusekelwa kwephrothokholi, hhayi inani lamarutha. Ishubhu eliwa ngemuva kwemizuzu embalwa yokuthula ukufaniswa okuphelelwa yisikhathi, futhi i-keepalive iyimpendulo evamile. I-IPsec inezandiso ze-NAT-traversal ezijwayelekile, ngakho ukusho ukuthi ayikwazi ukweqa ukuhumusha kumane kuyiphutha. Uma ishubhu lingakhi nhlobo, bheka iphoyinti lokugcina kanye nobufakazi ngaphambi kokusola ukuhlelwa kwenethiwekhi.

wg show
ping -c3 10.8.0.1

Yima uma ishubhu eliphumayo lisebenza kusuka kunethiwekhi eyodwa hhayi kwelinye. Lokho kuqhathanisa kumayelana namanethiwekhi, hhayi inani lamarutha.

Ukungena: ukudlulisa kuhlanganisa kuphela imishini oyiphethe

Ukusingatha iseva kuwukuphambuka: ukuxhumana okusha kufika kusuka ku-inthanethi futhi kufanele kufinyelele emshinini wakho kuyo yonke ingqimba. Umthetho wokudlulisa ichweba kurutha yangaphakathi usiza kuphela uma umhumushi wangaphandle futhi ekuletha lokho kuhamba kuwe. Ukuphinda umthetho wangaphakathi akukunikezi ukulawula imishini yomhlinzeki.

nc -vz 203.0.113.10 51820
ss -lunp 'sport = :51820'

Qhathanisa ikheli le-WAN lerutha yangaphakathi nekhasi lomphakathi olibonile, futhi ubhale ukuthi inani ngalinye lavela kuphi. Uma ikheli le-WAN lingelomuntu siqu noma lisemkhakheni owabiwe, ingqimba yangaphandle yenza ukuhumusha ongakwazi ukukucushwa. Buza umhlinzeki ukuthi yikuphi ukufinyeleleka kwangaphakathi akusekelayo ngaphambi kokuchitha ubusuku bonke emithethweni engeke isebenze. Ukususa irutha noma ukucisha isivikelo somlilo kabanzi akukona ukuxilonga, futhi kuwukushintshana okubi ngechweba elilodwa elivuliwe.

Yima uma ingqimba yangaphandle ingeyomhlinzeki futhi ingadlulisi. Khona-ke izimpendulo ezisekelwayo indlela ehlukile yokufinyelela noma i-relay, hhayi omunye umthetho ohlangothini lwakho.

Hlola okuguquguqukayo okukodwa ngesikhathi

Shintsha into eyodwa esivivinyweni ngasinye bese ubhala umphumela, ngoba indlela ye-NAT ekabili inezinto eziguquguqukayo eziningi kunendlela yerutha eyodwa. Gcina iphrofayela nedivayisi kungashintshi, bese uqhathanisa enye inethiwekhi yokufinyelela. Qaphela ukuthi ingxoxo iyahluleka yini, ukuthi iseshini iyawa yini ngemuva kokungenzi lutho, noma ukuthi izindawo zangasese kuphela ezihlulekayo. Lokho kuqaphela okuthathu kukhombisa izingqimba ezintathu ezihlukene.

journalctl -u wg-quick@wg0 -n 30 --no-pager
ip route get 10.20.30.40

Ama-subnet angasese anqamana awumbazo ehlukile okungekho inani lokuhumusha elingayilungisa. Uma inethiwekhi yasekhaya nenethiwekhi ekude zisebenzisa ibanga elifanayo, ukungqubuzana komzila kuvela kungakhathaliseki ukuthi bangaki abahumushi abaphakathi. Ukuphinda inombolo ohlangothini olulodwa yimpendulo ehlala isikhathi kuphela.

Isango elikude lifanelwe ukunakwa okufanayo, ngoba imithetho yalo yokudlulisa nemizila yokubuya kungase kube yingxenye engekho. Ishubhu eliqinisekisayo lingase lingabi nayo indlela yohlelo lokusebenza esebenzisekayo, futhi lokho kwehluleka kubonakala kufana ngasohlangothini lweklayenti. Uhambo luphela lapho usukwazi ukusho ukuthi iyiphi indlela ehlulekayo nokuthi iyiphi ingqimba engumnikazi wayo.