Amaklayenti angaphansi ngemuva kwe-VPN ephezulu: umzila noma i-NAT?

Igesi elilodwa lisebenzisa i-WireGuard emishinini yakho kanye neklayenti le-OpenVPN eliya kunethiwekhi yomunye umuntu. Ukudlulisela phakathi kwalezi zixhumi ezimbili zangaphakathi kuyasebenza, futhi kulula ukuphetha ngokuthi i-subnet engaphansi manje isiyingxenye yesevisi ephezulu. Akunjalo. Umzila okhishwa yiklayenti utshela igesi yakho ukuthi izicelo ziya kuphi; awusho lutho mayelana nokuthi inethiwekhi ekude ibuyisela kanjani ithrafikhi kumadivayisi engakaze izwe ngawo. Khetha imodeli yokubuyisela i-ephezulu eyisekelayo ngempela ngaphambi kokufaka ngisho umthetho owodwa.

Nquma imodeli yokubuyisela ngaphambi kokuthinta ukuhlela umzila

Kulesi sikhombisi, amaklayenti angaphansi asebenzisa i-10.90.0.0/24, ikheli lethuneli ephezulu elinikezwe igesi yi-10.80.0.6, futhi insiza ekude egunyaziwe yi-172.20.0.30. Amamodeli amabili ahambisana naleso simo: gcina umthombo ongaphansi bese wenza uhlangothi olukude uluhlele, noma humusha umthombo ube ikheli lethuneli legesi uqobo. Konke okulandela lesi sinqumo kungokomshini, futhi isinqumo ngokwaso sidinga umnikazi wesevisi. Omunye umugqa ngenhla uyisivumelwano sokuhlela umzila nohlangothi olukude; omunye ukushintshwa kwengqubo yasendaweni ongakwenza wedwa. Ukuhlanganisa lokhu kokubili yikho okuguqula ushintsho lwemizuzu eyishumi lube yizingxoxo.

preserved:  10.90.0.23 -> 172.20.0.30
translated: 10.80.0.6  -> 172.20.0.30

Khetha umugqa owodwa bese unamathela kuwo. Imigqa iyizindlela ezihlukene, hhayi izinyathelo, futhi ukuyihlanganisa kukhiqiza umklamo okungekho muntu ongawuchaza ekubuyekezweni.

Ukwagcinwa komthombo ngomzila

Uhlangothi olukude lwamukela isicelo esivela ekhelini elingaphansi, ngakho ludinga umzila osekelwayo kanye nobunikazi be-peer balezo subnet, kanye negunya lokuyamukela. Lezi yizilungiselelo ezikude, futhi awukho umzila wasendaweni we-Linux owudala. Zicela ngokucacile nangokubhala, ne-prefix kanye ne-peer yethuneli ezozithwala, futhi ulindele ukuthi impendulo izoncika ekutheni isevisi iyakusekela yini ukuhlelwa kwe-site-to-site.

Uma impendulo ingu-yebo, ukulungiselelwa kwasendaweni kuncane: ukudlulisela kuvuliwe, ama-allowed-ips e-peer ye-WireGuard ahlanganisa ibanga elingaphansi, kanye nenqubo ye-firewall evumela ukuwela kuzinhlangothi zombili.

Ukuhumusha komthombo ngamabomu

Uma isevisi ibuyisela ithrafikhi ekhelini leklayenti elixhunyiwe kuphela, humusha umthombo ube yilelo kheli lapho uphuma bese ugcina isimo se-conntrack esikubuyisela emuva ngezimpendulo. Khawulela umthetho emithonjeni engaphansi ehlosiwe, ezindaweni ezikude ezihlosiwe kanye nesixhumi esiphezulu. Umthetho ohumusha konke okuphuma kusixhumi ngasinye unguquko olukhulu kakhulu kunalesi sidingo, futhi uzokumangaza kamuva.

I-IPv6 idinga umklamo wayo; ukukopisha umugqa we-masquerade ye-IPv4 akusona isakhiwo. Hlola umzila ohumushiwe ngoxhumano olusha hhayi olugcinwe kusilondolozi.

Umzila wedatha wasendaweni kusamele usebenze

Ukuhumusha akukususi ukusebenza kwasendaweni: igesi isadinga umzila oya ezindaweni ezingaphansi, ubunikazi obulungile bomthombo we-peer ye-WireGuard, ukudlulisela okuvuliwe kanye nenqubo encane ye-firewall phakathi kwezixhumi. Isicelo esidalwe egesini uqobo asizihloli lezo zimvume, yingakho izivivinyo zasendaweni egesini ziphumelela kuyilapho amadivayisi angaphansi ehluleka.

Hlola kudivayisi langaphansi langempela, hhayi egesini. Ikheli lomthombo liyiyo yonke inhloso yalo msebenzi.

Umthombo owodwa usho ubunikazi besikhathi esisodwa

Isevisi ekude ibona isikhathi esiqinisekisiwe segesi kanye nekheli laso elihumushiwe, hhayi ukuqinisekiswa okuzimele kwedivayisi ngayinye engaphansi. Gcina izimvume zedivayisi ngayinye kanye nobunikazi bezinhlelo kucacile, futhi qinisekisa kumnikazi wesevisi ukuthi igesi esebenzela amadivayisi amaningana ivunyelwe nhlobo. Ukuhumusha akusona isu lokweqa imfuneko yokubhalisa idivayisi ngayinye; uma isevisi idinga ukuthi idivayisi ngayinye ibhalise, sebenzisa leyo modeli noma xoxisana ngokuhlelwa kwe-site-to-site.

Bhala leso siqinisekiso ku-runbook eduze komthetho, ngoba umbuyekezi olandelayo uzobuza ukuthi umklamo wawugunyaziwe noma wawulula nje.

Chaza isimo sokunqamuka, bese uhlola izicelo ezintathu

Nquma ukuthi kwenzeka ngani lapho ithuneli ephezulu iwa. Ithrafikhi ekude egunyaziwe akufanele ilandele buthule umzila we-WAN wokulondoloza ojwayelekile lapho lokho kwenqatshelwe, ngakho inqubo ye-firewall evumela ukuwela kufanele nayo yehluleke ivaliwe. Bese uhlola izimo ezintathu kudivayisi langaphansi langempela: isicelo esivunyelwe esisebenzayo, isicelo esingavunyelwe esihlulekayo, kanye nokuhluleka kwephezulu okumisa esivunyelwe.

Bhala ukuhoxiswa ngomugqa owodwa ngomthetho ngamunye, ukuze ushintsho luhoxiswe ngaphandle kokwakha kabusha inhloso.