I-eth0:0 iyilebula, hhayi idivayisi: lungisa ukufana kwe-SNAT

Isibali esingu-zero sisho ukuthi umthetho ubiza i-interface engenakuba khona. Funda idivayisi yangempela, lungisa ukufana kwe -o bese ukhetha ikheli elihunyushiwe ngamabomu.

Umthetho we-NAT obekufanele unikeze iqembu elilodwa lamaklayenti e-VPN ikheli lalo lomphakathi uyagoma kumaphakethe angu-zero, kuyilapho lelo qembu liqhubeka liphuma ngomthombo ongafanele. Umthetho ngokuvamile awenzi iphutha ekhelini; wenza iphutha ku-interface. -o eth0:0 ukhombisa idivayisi engekho, ngoba eth0:0 iyilebula elixhunywe ekhelini elikwi eth0. Ukubheka izibali kuyindlela esheshayo yokuqinisekisa lokho, futhi ukulungisa kuncane kunalokho okushiwo uphenyo.

Hlola ukuthi i-kernel ibiza ini idivayisi

Funda ukubuka okubili ngokwehlukana ngaphambi kokushintsha noma yini:

ip link show
ip address show dev eth0
ip route get 203.0.113.20

Uhlu lwezixhumanisi lukhombisa ama-interface. Uhlu lwamakheli lungakhombisa ikheli le-IPv4 lesibili eliphethe ilebula eth0:0, futhi idivayisi yalelo kheli iseyi eth0. Incwadi yamakheli ye-iproute2 ibheka ilebula njengegama lekheli, hhayi njengesixhumanisi sesibili, futhi yilo mehluko inqubo yonke egxile kuwo.

Umlando uchaza ukudideka. Isintaksi sakudala ifconfig eth0:0 sasibukeka ngempela njenge-interface entsha, futhi izikripthi zangaleso sikhathi zisabhekisela komunye. Kusistimu yanamuhla, i-alias iyilebula ekhelini, futhi akukho lutho endleleni ye-routing noma ye-netfilter oluyibheka njengendawo yokuphuma ehlukile.

Hlola ukuthi umthetho wafanisa nani ngempela

Funda izibali kanye nohlu lwemithetho, hhayi ngenkumbulo:

iptables -t nat -L POSTROUTING -v -n --line-numbers

Umthetho isibali sawo samaphakethe esihlala singu-zero ngenkathi kuhamba ithrafikhi efanayo awuhlolwa, futhi isimo se-interface yokuphuma esibiza eth0:0 siyimbangela evamile. Idivayisi yokuphuma ekhethwe yi-route yi eth0, ngakho isimo esifuna elinye igama asisoze sibe yiqiniso, noma ngabe i-kernel ikhethe liphi ikheli lomthombo.

Shintsha isimo sibe idivayisi yangempela futhi ushiye ilebula ngaphandle. Uma udinga ukuhlukanisa amaqembu amabili amaklayenti abelana ngaleyo divayisi, wahlukanise nge-prefix yomthombo, hhayi ngegama le-interface elingenakuba khona. Imithetho emibili enokufana -s okungagqagelani iyafundeka futhi iyahlolwa; umthetho owodwa onedivayisi eqanjiwe akusiyo nakunye kwalokho. Nika umthetho ngamunye umbhalo obiza iqembu, ngoba emva kwezinyanga eziyisithupha i-prefix iyodwa ngeke isho muntu ukuthi kungani ikhona.

Hlola i-route ekhethe idivayisi

I-NAT ye-postrouting isebenza ngemva kokuba i-route isikhethe i-interface yokuphuma, ngakho i-interface kumthetho kumele kube yileyo ekhethwe yi-route. Buza i-kernel ngqo nge ip route get kukheli lomklayenti elimelela futhi ufunde kokubili idivayisi nomthombo oyikubikayo.

Uma impendulo ibiza eth0, ingxenye ye-interface yomthetho isixazululiwe. Uma ibiza idivayisi yomhubhe, iphakethe alisoze lifinyelele umthetho oyihlolayo, futhi ukusesha kudlulela kuthebula le-routing kanye nokubaluleka kwalo. Umthetho ongafani nanini ngoba iphakethe liphume kwenye indawo ubonakala ekukhishweni kwezibali njengomthetho onedivayisi ebhalwe ngokungalungile. Qinisekisa ukuthi yikuphi kulezi zimo ezimbili onawo ngaphambi kokuhlela noma yini, ngoba eyesibili idinga ushintsho lwe-routing hhayi lombhalo.

Khetha umthombo ohunyushiwe ngamabomu

Uma idivayisi isilungile, ikheli lomthombo isinqumo esihlukile. Lona umane uyisibonelo seqembu le-IPv4 nekheli lesibonelo:

iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -o eth0 \
  -j SNAT --to-source 203.0.113.20

Ukubhala ikheli ku --to-source akwenzi muntu ukuthi aliroute libuyele kuwe. Umhlinzeki waphezulu noma umnikazi wekheli kumele aletha izimpendulo zalelo kheli kule host, futhi ikheli kumele libe elilodwa olinikezwe igunya lokulisebenzisa. Uma kungenjalo, umthetho uzofana futhi uhunyushe futhi izimpendulo zisazokuya kwenye indawo.

Ukushintsha ikheli lomthombo akufani nokushintsha isixhumanisi esiphezulu. Uma isidingo sangempela kuyindlela ehlukile yomzimba, inqubomgomo ye-routing kumele iqale ikhethe leyo ndlela; bese i-SNAT ibhala kabusha umthombo kudivayisi ekhethwe yinqubomgomo. Amalebula engeziwe ku eth0 awanikezi i-route noma igunya.

Qinisekisa ngoxhumano osanda kuluvula

Vula uxhumano olusha lomklayenti esikhundleni sokusebenzisa olukhona. Ukulandelela ukuxhumana kugcina inguqulo eyayiqoshiwe lapho kwakuqala ukugeleza, ngakho isikhathi esidala singaqhubeka sisebenzisa ikheli lomthombo langaphambili futhi lenze umthetho omusha olungile ubonakale uphukile. Bheka isibali sikhuphuka, bese ubheka umthombo ohunyushiwe ocingweni noma ekugcineni okude.

Emaqenjini amaningi abelana i-interface eyodwa, nika ngalinye ukufana komthombo okucacile nekheli lalo lokuhumusha, wagcine ekucushweni okulawulwayo kwe-firewall futhi ubhale ukuhleleka okuhlolwa ngakho. Bese ubhala lokho okukuqinisekisile: idivayisi evela ku ip route get, isibali esinyakazile, kanye nomthombo obonwe uhlangothi olude. Lowo mbhalo uphendula umbiko olandelayo ngaphandle kokuphinda ukudideka kwelebula.

Izihloko ezihlobene